Edit tour

Windows Analysis Report
lumma.exe

Overview

General Information

Sample name:	lumma.exe
Analysis ID:	1629159
MD5:	96da4c9b10159e9a9a38a2e6aacbc984
SHA1:	0df08d596c3b70533420412ba1a544aeb34c66cc
SHA256:	5c92f798fdd43e235e03359efc6cb053d9aca99edd5f3be2eb4caf00e09e4fa3
Tags:	exeLummaStealeruser-threatcat_ch
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Dllhost Internet Connection

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

lumma.exe (PID: 6844 cmdline: "C:\Users\user\Desktop\lumma.exe" MD5: 96DA4C9B10159E9A9A38A2E6AACBC984)

InstallUtil.exe (PID: 5664 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

svchost.exe (PID: 4820 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 792 cmdline: "C:\Windows\System32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 340 cmdline: --user-data-dir="C:\Users\user\AppData\Local\Temp\chrF5B6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2036,i,347058465105131194,15016931794279855737,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

wmlaunch.exe (PID: 3084 cmdline: "C:\Program Files\Windows Media Player\wmlaunch.exe" MD5: 836F3636C231980EAD81C84BCA55D82B)

dllhost.exe (PID: 3696 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

dllhost.exe (PID: 2084 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

WerFault.exe (PID: 1360 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 508 MD5: C31336C1EFC2CCB44B4326EA793040F2)

AvastBrowserUpdate.exe (PID: 2180 cmdline: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe MD5: FBF01416F4C0B56D725E9296C2521487)

svchost.exe (PID: 6152 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 6524 cmdline: "C:\Windows\System32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 7116 cmdline: --user-data-dir="C:\Users\user\AppData\Local\Temp\chrA791.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/c1ff4a97/4a1b3c1a" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6752 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2356,i,6262889531060732186,15388988117095417937,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000018.00000003.2414381682.0000000001880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000007.00000003.1971429702.0000000004FB0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000018.00000002.2422321579.0000000003D90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000019.00000002.2499439978.0000000003880000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000002.1957104876.0000000002790000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000007.00000002.2045084480.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000019.00000003.2423378587.00000000059C0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.1952419191.00000000007F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1961637127.00000000057C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000019.00000003.2419272459.00000000033F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000019.00000003.2423051619.00000000057A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000018.00000003.2417392072.00000000043B0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: lumma.exe PID: 6844	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: lumma.exe PID: 6844	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 4820	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: AvastBrowserUpdate.exe PID: 2180	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.lumma.exe.57c0000.6.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.lumma.exe.57c0000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
7.3.svchost.exe.4d90000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
24.3.AvastBrowserUpdate.exe.4190000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.svchost.exe.4d90000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.svchost.exe.4d90000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.svchost.exe.4fb0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
25.3.svchost.exe.59c0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
24.3.AvastBrowserUpdate.exe.43b0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
25.3.svchost.exe.57a0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.svchost.exe.4fb0000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 6 entries

Sigma Signatures

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 91.240.118.2, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 3696, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49842

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ParentProcessId: 5664, ParentProcessName: InstallUtil.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 4820, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ParentProcessId: 5664, ParentProcessName: InstallUtil.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 4820, ProcessName: svchost.exe

Suricata Signatures

ETPRO JA3 HASH Suspected Malware Related Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T12:47:06.284033+0100	2854824	2	Potentially Bad Traffic	91.240.118.2	9769	192.168.2.4	49745	TCP
2025-03-04T12:47:15.888964+0100	2854824	2	Potentially Bad Traffic	91.240.118.2	9769	192.168.2.4	49780	TCP
2025-03-04T12:47:49.931463+0100	2854824	2	Potentially Bad Traffic	91.240.118.2	9769	192.168.2.4	50024	TCP
2025-03-04T12:47:59.541065+0100	2854824	2	Potentially Bad Traffic	91.240.118.2	9769	192.168.2.4	50060	TCP

ETPRO MALWARE Possible Malicious Second Stage Download with Terse Headers

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T12:46:39.150557+0100	2833022	1	A Network Trojan was detected	188.114.97.3	443	192.168.2.4	49734	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T12:46:18.545167+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	50064	TCP
2025-03-04T12:46:47.349945+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	9769	192.168.2.4	49735	TCP
2025-03-04T12:47:06.284033+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	9769	192.168.2.4	49745	TCP
2025-03-04T12:47:15.888964+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	9769	192.168.2.4	49780	TCP
2025-03-04T12:47:23.198537+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	49842	TCP
2025-03-04T12:47:29.809442+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	49891	TCP
2025-03-04T12:47:32.814207+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	9769	192.168.2.4	49912	TCP
2025-03-04T12:47:36.439586+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	49934	TCP
2025-03-04T12:47:43.045454+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	49975	TCP
2025-03-04T12:47:49.692836+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	50020	TCP
2025-03-04T12:47:49.931463+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	9769	192.168.2.4	50024	TCP
2025-03-04T12:47:56.453605+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	50059	TCP
2025-03-04T12:47:59.541065+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	9769	192.168.2.4	50060	TCP
2025-03-04T12:48:04.083045+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	50061	TCP
2025-03-04T12:48:10.721863+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	50062	TCP
2025-03-04T12:48:17.345884+0100	2854802	1	Domain Observed Used for C2 Detected	91.240.118.2	443	192.168.2.4	50063	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1957017064.0000000003E54000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f"}

Multi AV Scanner detection for submitted file

Source: lumma.exe	Virustotal: Detection: 46%			Perma Link
Source: lumma.exe	ReversingLabs: Detection: 42%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D86B88 CryptUnprotectData,	11_2_00007DF464D86B88
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A38D4 CryptProtectData,	16_3_00007DF43E2A38D4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838 CryptProtectData,CreateFileW,WriteFile,CloseHandle,free,	16_3_00007DF43E2A3838
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C698EEC zip_fopen_index,zip_fopen_index_encrypted,	24_2_6C698EEC
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C636960 CryptHashCertificate,	24_2_6C636960
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C636B60 CryptQueryObject,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertCloseStore,	24_2_6C636B60
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5CA591 CryptReleaseContext,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,	24_2_6C5CA591
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5C47F8 CryptProtectData,LocalFree,	24_2_6C5C47F8
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C694312 CryptAcquireContextW,GetLastError,CryptReleaseContext,	24_2_6C694312
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6358C9 CryptHashData,	24_2_6C6358C9
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C63592F CryptVerifySignatureW,CryptDestroyHash,CryptDestroyKey,	24_2_6C63592F
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C615554 CryptUnprotectData,GetLastError,LocalFree,	24_2_6C615554
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C69D76E zip_fopen_index_encrypted,zip_source_open,zip_source_free,	24_2_6C69D76E
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C63570A CryptDecodeObjectEx,CryptImportPublicKeyInfo,CryptCreateHash,	24_2_6C63570A

Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_6b9ac9f7-b

Source: lumma.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50064 version: TLS 1.2

Source: lumma.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: svchost.exe, 00000007.00000003.1970795284.0000000000D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970883004.0000000004E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1971429702.0000000004FB0000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: lumma.exe, 00000000.00000002.1962446070.00000000058C0000.00000004.08000000.00040000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003DD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: svchost.exe, 00000007.00000003.1970126231.0000000004F80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1969928728.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2415573190.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000007.00000003.1970575295.0000000004F30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970404014.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2416164043.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: svchost.exe, 00000007.00000003.1970126231.0000000004F80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1969928728.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2415573190.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: lumma.exe, 00000000.00000002.1962446070.00000000058C0000.00000004.08000000.00040000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003DD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, 00000007.00000003.1970575295.0000000004F30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970404014.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2416164043.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmlaunch.exe, wmlaunch.exe, 00000010.00000003.2314246638.000001A4F8F30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2314293957.000001A4F9080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: AvastBrowserUpdate_unsigned.pdb source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp, AvastBrowserUpdate.exe, AvastBrowserUpdate.exe, 00000018.00000000.2385120400.0000000000A41000.00000020.00000001.01000000.00000022.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: svchost.exe, 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1971429702.0000000004FB0000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: svchost.exe, 00000007.00000003.1970795284.0000000000D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970883004.0000000004E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmlaunch.exe, 00000010.00000003.2314246638.000001A4F8F30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2314293957.000001A4F9080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: TEST_goopdate_unsigned.pdb source: wmlaunch.exe, 00000010.00000003.2784967822.000001A4FB970000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376090447.000001A4FB972000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D81618 FindFirstFileW,DeleteFileW,FindNextFileW,RemoveDirectoryW,	11_2_00007DF464D81618
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5B6118 FindFirstFileW,FindClose,FindNextFileW,	24_2_6C5B6118
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5878C0 FindFirstFileW,GetLastError,_wcslen,DeleteFileW,FindNextFileW,GetLastError,FindClose,	24_2_6C5878C0
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C587A07 GetFileAttributesW,GetLastError,_wcslen,FindFirstFileW,GetLastError,_wcslen,_wcslen,FindNextFileW,FindClose,RemoveDirectoryW,	24_2_6C587A07
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5A944D FindFirstFileW,FindNextFileW,FindClose,	24_2_6C5A944D
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C589507 FindFirstFileW,FindNextFileW,FindClose,	24_2_6C589507
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C58D6DE FindFirstFileW,FindNextFileW,FindClose,	24_2_6C58D6DE
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C587789 FindFirstFileW,FindNextFileW,GetLastError,FindClose,	24_2_6C587789
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5C92EE FindFirstFileW,GetLastError,PathStripPathW,PathStripPathW,PathStripPathW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,FindNextFileW,GetLastError,FindClose,	24_2_6C5C92EE

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C591FC7 GetLogicalDriveStringsW,QueryDosDeviceW,_wcslen,_wcslen,

24_2_6C591FC7

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 4x nop then dec esp	11_2_000001AAC0340511
Source: C:\Windows\System32\svchost.exe	Code function: 4x nop then dec esp	11_2_00007DF464D925B1
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 4x nop then dec esp	16_2_000001A4F8D65681

Source: chrome.exe

Memory has grown: Private usage: 11MB later: 23MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:9769 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:9769 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:9769 -> 192.168.2.4:49780
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:49842
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:49891
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:9769 -> 192.168.2.4:49912
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:49934
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:49975
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:50020
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:9769 -> 192.168.2.4:50024
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:9769 -> 192.168.2.4:50060
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:50059
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:50061
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:50062
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:50063
Source: Network traffic	Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 91.240.118.2:443 -> 192.168.2.4:50064

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 91.240.118.2 9769

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 91.240.118.2:9769

Source: global traffic	HTTP traffic detected: GET /stable.bin HTTP/1.1Host: ovalre.usConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /RIRzat8.png HTTP/1.1Host: i.imgur.comAccept: /

Source: Joe Sandbox View	IP Address: 194.58.203.20 194.58.203.20
Source: Joe Sandbox View	IP Address: 213.239.239.164 213.239.239.164
Source: Joe Sandbox View	IP Address: 20.101.57.9 20.101.57.9

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: caec7ddf6889590d999d7ca1b76373b6

Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 91.240.118.2:9769 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 91.240.118.2:9769 -> 192.168.2.4:49780
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 91.240.118.2:9769 -> 192.168.2.4:50024
Source: Network traffic	Suricata IDS: 2854824 - Severity 2 - ETPRO JA3 HASH Suspected Malware Related Response : 91.240.118.2:9769 -> 192.168.2.4:50060
Source: Network traffic	Suricata IDS: 2833022 - Severity 1 - ETPRO MALWARE Possible Malicious Second Stage Download with Terse Headers : 188.114.97.3:443 -> 192.168.2.4:49734

Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.2

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C6163A9 HttpQueryInfoW,InternetReadFile,InternetQueryDataAvailable,

24_2_6C6163A9

Source: global traffic	HTTP traffic detected: GET /stable.bin HTTP/1.1Host: ovalre.usConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /RIRzat8.png HTTP/1.1Host: i.imgur.comAccept: /

Source: global traffic	DNS traffic detected: DNS query: ovalre.us
Source: global traffic	DNS traffic detected: DNS query: ntp.time.nl
Source: global traffic	DNS traffic detected: DNS query: time.facebook.com
Source: global traffic	DNS traffic detected: DNS query: gbg1.ntp.se
Source: global traffic	DNS traffic detected: DNS query: time.google.com
Source: global traffic	DNS traffic detected: DNS query: ts1.aco.net
Source: global traffic	DNS traffic detected: DNS query: x.ns.gin.ntt.net
Source: global traffic	DNS traffic detected: DNS query: time-a-g.nist.gov
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com
Source: global traffic	DNS traffic detected: DNS query: ntp.time.in.ua
Source: global traffic	DNS traffic detected: DNS query: ntp1.hetzner.de
Source: global traffic	DNS traffic detected: DNS query: time.windows.com

Source: svchost.exe, 0000000B.00000003.2222031616.000001AAC0C12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0
Source: chrome.exe, 0000000C.00000002.2197135422.00002FB00014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199188707.00002FB000590000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201439544.00002FB0009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198638874.00002FB000530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2196753198.00002FB000078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1/
Source: chrome.exe, 0000000C.00000002.2199188707.00002FB000590000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201439544.00002FB0009F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1/_
Source: wmlaunch.exe, 00000010.00000003.2755170678.00007DF43E2AD000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2354997200.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2348107704.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000002.2968680582.00007DF43E2DD000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2355272642.000001A4F904B000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2348233895.000001A4F902A000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2755310403.000001A4FB061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/json/list?t=%u
Source: wmlaunch.exe, 00000010.00000003.2755170678.00007DF43E2AD000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2354997200.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2348107704.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000002.2968680582.00007DF43E2DD000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2355272642.000001A4F904B000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2348233895.000001A4F902A000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2755310403.000001A4FB061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/json/list?t=%u...
Source: wmlaunch.exe, 00000010.00000003.2348107704.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2755310403.000001A4FB061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/json/list?t=%uws:exodus.jsExodusatomic.jsAtomicguarda.jsGuardainfinity.jsInfinit
Source: chrome.exe, 0000000C.00000002.2204803352.000034C400238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199802841.00002FB0006C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201439544.00002FB0009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200176301.00002FB000774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2204929620.000034C400264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201691011.00002FB000A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201488104.00002FB000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201081648.00002FB000964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2207794024.0000661400238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a
Source: chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a/
Source: chrome.exe, 0000000C.00000002.2201439544.00002FB0009F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a0(p
Source: chrome.exe, 0000000C.00000002.2204846711.000034C400248000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a4
Source: chrome.exe, 0000000C.00000002.2199802841.00002FB0006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a=
Source: chrome.exe, 0000000C.00000002.2207794024.0000661400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1af
Source: chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1ainFrame
Source: chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1aination
Source: chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1append
Source: chrome.exe, 0000000C.00000002.2200176301.00002FB000774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8000/dcf7ac3d/4a1b3c1ayPolicy
Source: svchost.exe, 0000000B.00000003.2222031616.000001AAC0C12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.01:
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970M
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498J
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384)
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535;
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/60413
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/67554
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876K
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370H
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280:
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 0000000C.00000002.2199222971.00002FB0005A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: lumma.exe, 00000000.00000002.1961022357.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: lumma.exe, 00000000.00000002.1961022357.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: lumma.exe, 00000000.00000002.1961022357.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.msoftp
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: chrome.exe, 0000000C.00000002.2196992568.00002FB0000EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 0000000C.00000002.2196783250.00002FB0000AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: chrome.exe, 0000000C.00000002.2200898180.00002FB0008DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chrome.exe, 0000000C.00000002.2201081648.00002FB000964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 0000000C.00000002.2201081648.00002FB000964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.avast.com0/
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 0000000C.00000002.2201488104.00002FB000A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: lumma.exe, 00000000.00000000.1699671929.0000000000812000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: svchost.exe, svchost.exe, 0000000B.00000002.2435739766.000001AAC0340000.00000040.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2437125043.000001AAC05CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2436920891.000001AAC055E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2438087941.000001AAC0CEE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2434134815.000001AAC055E000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000002.2967068205.000001A4F91F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2435739766.000001AAC0340000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343fkernelbasentdllkernel32GetProcessMitig
Source: svchost.exe, 00000007.00000002.2043833983.000000000067C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343fx
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2196783250.00002FB000084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 0000000C.00000002.2196608780.00002FB00000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 0000000C.00000002.2199264156.00002FB0005D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2196783250.00002FB000084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 0000000C.00000002.2201488104.00002FB000A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 0000000C.00000002.2201488104.00002FB000A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1ipelines)
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 0000000C.00000002.2196933671.00002FB0000C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 0000000C.00000002.2196933671.00002FB0000C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 0000000C.00000002.2196933671.00002FB0000C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 0000000C.00000002.2196783250.00002FB000084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin/
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/72467
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319F
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000C.00000002.2200134575.00002FB000734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198397887.00002FB000490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico.
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icobility.
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icoBA8
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 0000000C.00000002.2201811497.00002FB000AD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 0000000C.00000002.2201811497.00002FB000AD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 0000000C.00000002.2201811497.00002FB000AD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199264156.00002FB0005D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200898180.00002FB0008DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000000C.00000002.2199222971.00002FB0005A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 0000000C.00000002.2200521741.00002FB000844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GB
Source: chrome.exe, 0000000C.00000002.2199935061.00002FB000707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GBWeb
Source: chrome.exe, 0000000C.00000002.2199935061.00002FB000707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GB~p
Source: chrome.exe, 0000000C.00000002.2203370226.00002FB000CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197609580.00002FB0002A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2188423161.00002FB000CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 0000000C.00000002.2196608780.00002FB00000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: svchost.exe, 0000000B.00000003.2217055485.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2198859150.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2195628441.000001AAC0C02000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2161911156.00006614002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2161882858.00006614002D8000.00000004.00000800.00020000.00000000.sdmp, AvastBrowserUpdate.exe	String found in binary or memory: https://clients2.google.com/cr/report
Source: wmlaunch.exe, 00000010.00000003.2784967822.000001A4FB970000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376090447.000001A4FB972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportcheckpointGoogle
Source: AvastBrowserUpdate.exe	String found in binary or memory: https://clients2.google.com/service/check2?crx3=true
Source: wmlaunch.exe, 00000010.00000003.2784967822.000001A4FB970000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376090447.000001A4FB972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/check2?crx3=trueCodeRedUrlSoftware
Source: chrome.exe, 0000000C.00000002.2196963956.00002FB0000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 0000000C.00000002.2199304618.00002FB0005EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2196608780.00002FB00000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199222971.00002FB0005A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199116230.00002FB00057C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx/
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx0
Source: chrome.exe, 0000000C.00000002.2197135422.00002FB00014C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: AvastBrowserUpdate.exe	String found in binary or memory: https://clients5.google.com/tbproxy/usagestats
Source: wmlaunch.exe, 00000010.00000003.2784967822.000001A4FB970000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376090447.000001A4FB972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients5.google.com/tbproxy/usagestatshttps://m.google.com/devicemanagement/data/apihttps://
Source: chrome.exe, 0000000C.00000002.2199304618.00002FB0005EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199222971.00002FB0005A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: svchost.exe, 00000007.00000003.2005999709.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-query
Source: svchost.exe, 00000007.00000003.2005999709.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi
Source: svchost.exe, 0000000B.00000003.2217055485.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2198859150.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: svchost.exe, 0000000B.00000003.2217055485.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2198859150.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 0000000C.00000002.2200134575.00002FB000734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198397887.00002FB000490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2200134575.00002FB000734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198397887.00002FB000490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2200521741.00002FB000844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 0000000C.00000002.2200521741.00002FB000844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: chrome.exe, 0000000C.00000002.2196722618.00002FB00006C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2196651028.00002FB000030000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 0000000C.00000002.2199222971.00002FB0005A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: wmlaunch.exe, 00000010.00000003.2785382357.000001A4FB043000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.imgur.com/RIRzat8.png
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2164468965.00002FB0001B8000.00000004.00000800.00020000.00000000.sdmp, AvastBrowserUpdate.exe	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000000C.00000002.2200134575.00002FB000734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198397887.00002FB000490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 0000000C.00000002.2198337438.00002FB000474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 0000000C.00000002.2200062575.00002FB000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198337438.00002FB000474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 0000000C.00000002.2200062575.00002FB000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198337438.00002FB000474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ovalre.us
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ovalre.us/stable.bin
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ovalre.us/stable.binh
Source: chrome.exe, 0000000C.00000002.2196783250.00002FB000084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 0000000C.00000002.2196783250.00002FB000084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp, lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: svchost.exe, 0000000B.00000003.2191497385.000001AAC05F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2217055485.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2198859150.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2190579685.000001AAC0E69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2191416224.000001AAC05F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2252636239.000001AAC05FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2190467692.000001AAC0ED2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2196357609.000001AAC0CF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: svchost.exe, 0000000B.00000003.2191416224.000001AAC05F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Cz_
Source: svchost.exe, 0000000B.00000003.2190579685.000001AAC0E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: svchost.exe, 0000000B.00000003.2191416224.000001AAC05F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2252636239.000001AAC05FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2190467692.000001AAC0ED2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2196357609.000001AAC0CF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: svchost.exe, 0000000B.00000003.2191497385.000001AAC05F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2191416224.000001AAC05F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17(
Source: svchost.exe, 0000000B.00000003.2190579685.000001AAC0E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chrome.exe, 0000000C.00000002.2201488104.00002FB000A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/nC
Source: AvastBrowserUpdate.exe	String found in binary or memory: https://update.googleapis.com/service/update2
Source: chrome.exe, 0000000C.00000002.2201021436.00002FB000938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ww.google.com/
Source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 0000000C.00000002.2196608780.00002FB00000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199264156.00002FB0005D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000C.00000002.2201053420.00002FB000954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 0000000C.00000002.2201053420.00002FB000954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198268258.00002FB000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198766447.00002FB00055C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico)
Source: chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icocStateWorks
Source: AvastBrowserUpdate.exe	String found in binary or memory: https://www.google.com/support/installer/?
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 0000000C.00000002.2196608780.00002FB00000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198706344.00002FB000548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197394902.00002FB00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: lumma.exe, 00000000.00000000.1699671929.0000000000812000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.240.118.2:443 -> 192.168.2.4:50064 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C5914B6 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

24_2_6C5914B6

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C5914B6 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

24_2_6C5914B6

Source: svchost.exe, 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_071ac9bc-3

Source: svchost.exe, 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_93a77076-5

Source: Yara match	File source: 7.3.svchost.exe.4d90000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.AvastBrowserUpdate.exe.4190000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.svchost.exe.4d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.svchost.exe.4d90000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.svchost.exe.4fb0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.svchost.exe.59c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.AvastBrowserUpdate.exe.43b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.svchost.exe.57a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.svchost.exe.4fb0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.1971429702.0000000004FB0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2423378587.00000000059C0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2423051619.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2417392072.00000000043B0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AvastBrowserUpdate.exe PID: 2180, type: MEMORYSTR

Source: C:\Windows\System32\svchost.exe

Code function: 11_2_00007DF464D81364 CreateDesktopW,CreateProcessW,GetExitCodeProcess,TerminateProcess,

11_2_00007DF464D81364

Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000001AAC03415C0 NtAcceptConnectPort,	11_2_000001AAC03415C0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000001AAC0341CF4 NtAcceptConnectPort,CloseHandle,	11_2_000001AAC0341CF4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8F76C calloc,DuplicateHandle,NtAcceptConnectPort,free,NtAcceptConnectPort,NtAcceptConnectPort,	11_2_00007DF464D8F76C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8FFDC RtlDosPathNameToNtPathName_U,NtAcceptConnectPort,NtAcceptConnectPort,free,	11_2_00007DF464D8FFDC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8EFCC NtAcceptConnectPort,	11_2_00007DF464D8EFCC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8EFAC NtAcceptConnectPort,	11_2_00007DF464D8EFAC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8F0B8 NtAcceptConnectPort,	11_2_00007DF464D8F0B8
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8F244 NtAcceptConnectPort,	11_2_00007DF464D8F244
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8F224 NtAcceptConnectPort,	11_2_00007DF464D8F224
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D90188 calloc,NtAcceptConnectPort,free,	11_2_00007DF464D90188
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8EEF0 NtAcceptConnectPort,	11_2_00007DF464D8EEF0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1CE8 calloc,CreateProcessW,NtResumeThread,CloseHandle,free,	16_3_00007DF43E2B1CE8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B1958 calloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	16_3_00007DF43E2B1958
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D72EA0 NtAcceptConnectPort,	16_2_000001A4F8D72EA0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D72FD0 NtAcceptConnectPort,	16_2_000001A4F8D72FD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D72F74 NtAcceptConnectPort,	16_2_000001A4F8D72F74
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D72FA0 NtAcceptConnectPort,	16_2_000001A4F8D72FA0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D730BC NtAcceptConnectPort,	16_2_000001A4F8D730BC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D73078 NtAcceptConnectPort,	16_2_000001A4F8D73078
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D72B00 NtAcceptConnectPort,	16_2_000001A4F8D72B00
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D72C14 NtAcceptConnectPort,	16_2_000001A4F8D72C14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D7334C NtAcceptConnectPort,	16_2_000001A4F8D7334C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_00007DF43E2C2E90 NtQuerySystemInformation,free,NtQuerySystemInformation,	16_2_00007DF43E2C2E90
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_00007DF43E2F25D4 NtQuerySystemInformation,NtQuerySystemInformation,	16_2_00007DF43E2F25D4
Source: C:\Windows\System32\dllhost.exe	Code function: 20_2_00000218C4C73854 NtQuerySystemInformation,	20_2_00000218C4C73854
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_7FE0042F NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,	24_3_7FE0042F
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_7FE0066F NtProtectVirtualMemory,	24_3_7FE0066F
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_01337FAB NtAllocateVirtualMemory,NtProtectVirtualMemory,VirtualFree,	24_2_01337FAB

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C61FD38: CreateFileW,DeviceIoControl,CloseHandle,

24_2_6C61FD38

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C59700B OpenSCManagerW,OpenServiceW,DeleteService,CloseServiceHandle,CloseServiceHandle,

24_2_6C59700B

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C58F189 CreateProcessAsUserW,

24_2_6C58F189

Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD2AE0	0_2_02AD2AE0
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD2E18	0_2_02AD2E18
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD1388	0_2_02AD1388
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD10B0	0_2_02AD10B0
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD1D14	0_2_02AD1D14
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02ADCA60	0_2_02ADCA60
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02ADCA50	0_2_02ADCA50
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD2B91	0_2_02AD2B91
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD1383	0_2_02AD1383
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD13C2	0_2_02AD13C2
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD1439	0_2_02AD1439
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_02AD1923	0_2_02AD1923
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_0606F7E0	0_2_0606F7E0
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_0606F4F0	0_2_0606F4F0
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_0606DF68	0_2_0606DF68
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_06050006	0_2_06050006
Source: C:\Users\user\Desktop\lumma.exe	Code function: 0_2_06050040	0_2_06050040
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC0384A84	11_3_000001AAC0384A84
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC0382C73	11_3_000001AAC0382C73
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC0381BDD	11_3_000001AAC0381BDD
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC03827D3	11_3_000001AAC03827D3
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC0385EC8	11_3_000001AAC0385EC8
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC03855C8	11_3_000001AAC03855C8
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC0385948	11_3_000001AAC0385948
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000001AAC038252E	11_3_000001AAC038252E
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000001AAC0340C70	11_2_000001AAC0340C70
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D74040	11_2_00007DF464D74040
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D81364	11_2_00007DF464D81364
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D77E74	11_2_00007DF464D77E74
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D6286C	11_2_00007DF464D6286C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D7F408	11_2_00007DF464D7F408
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E5C52C	11_2_00007DF464E5C52C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D72500	11_2_00007DF464D72500
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4E4EC	11_2_00007DF464E4E4EC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4C4B0	11_2_00007DF464E4C4B0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DCD668	11_2_00007DF464DCD668
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DDD610	11_2_00007DF464DDD610
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DB56C0	11_2_00007DF464DB56C0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D61058	11_2_00007DF464D61058
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DBD050	11_2_00007DF464DBD050
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E5C010	11_2_00007DF464E5C010
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4DFB4	11_2_00007DF464E4DFB4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4EFBC	11_2_00007DF464E4EFBC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D65FA0	11_2_00007DF464D65FA0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DB6FB0	11_2_00007DF464DB6FB0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DCD100	11_2_00007DF464DCD100
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DB40B4	11_2_00007DF464DB40B4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DBF0C4	11_2_00007DF464DBF0C4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D95254	11_2_00007DF464D95254
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DCD210	11_2_00007DF464DCD210
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E3E1EC	11_2_00007DF464E3E1EC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4F354	11_2_00007DF464E4F354
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DC0344	11_2_00007DF464DC0344
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E54C70	11_2_00007DF464E54C70
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DD5BEC	11_2_00007DF464DD5BEC
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E68D64	11_2_00007DF464E68D64
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E6BD30	11_2_00007DF464E6BD30
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DB3D28	11_2_00007DF464DB3D28
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E2DC78	11_2_00007DF464E2DC78
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E87E4C	11_2_00007DF464E87E4C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4EE3C	11_2_00007DF464E4EE3C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E47D94	11_2_00007DF464E47D94
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E01D7C	11_2_00007DF464E01D7C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D9CD74	11_2_00007DF464D9CD74
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DCCF24	11_2_00007DF464DCCF24
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DC0EA0	11_2_00007DF464DC0EA0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E0A790	11_2_00007DF464E0A790
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DD1784	11_2_00007DF464DD1784
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4E908	11_2_00007DF464E4E908
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DA8910	11_2_00007DF464DA8910
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8D8B8	11_2_00007DF464D8D8B8
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DB5A0C	11_2_00007DF464DB5A0C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E4A9E4	11_2_00007DF464E4A9E4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D6F9A0	11_2_00007DF464D6F9A0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8198C	11_2_00007DF464D8198C
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D81B54	11_2_00007DF464D81B54
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464DE0AE4	11_2_00007DF464DE0AE4
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464E42A7C	11_2_00007DF464E42A7C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B4EFC	16_3_00007DF43E2B4EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B4EFC	16_3_00007DF43E2B4EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AF254	16_3_00007DF43E2AF254
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AF254	16_3_00007DF43E2AF254
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AFB14	16_3_00007DF43E2AFB14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AFB14	16_3_00007DF43E2AFB14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B07E8	16_3_00007DF43E2B07E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B07E8	16_3_00007DF43E2B07E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B3942	16_3_00007DF43E2B3942
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B3942	16_3_00007DF43E2B3942
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A01A0	16_3_00007DF43E2A01A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC230	16_3_00007DF43E2AC230
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E29F048	16_3_00007DF43E29F048
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E29F8E0	16_3_00007DF43E29F8E0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB902	16_3_00007DF43E2AB902
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B4EFC	16_3_00007DF43E2B4EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B4EFC	16_3_00007DF43E2B4EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B07E8	16_3_00007DF43E2B07E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B07E8	16_3_00007DF43E2B07E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AF254	16_3_00007DF43E2AF254
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AF254	16_3_00007DF43E2AF254
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AFB14	16_3_00007DF43E2AFB14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AFB14	16_3_00007DF43E2AFB14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B3942	16_3_00007DF43E2B3942
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B3942	16_3_00007DF43E2B3942
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B4EFC	16_3_00007DF43E2B4EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B4EFC	16_3_00007DF43E2B4EFC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A3838	16_3_00007DF43E2A3838
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A147C	16_3_00007DF43E2A147C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A1AD0	16_3_00007DF43E2A1AD0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A9FAC	16_3_00007DF43E2A9FAC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB5A0	16_3_00007DF43E2AB5A0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B07E8	16_3_00007DF43E2B07E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B07E8	16_3_00007DF43E2B07E8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A59DC	16_3_00007DF43E2A59DC
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2204	16_3_00007DF43E2B2204
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AF254	16_3_00007DF43E2AF254
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AF254	16_3_00007DF43E2AF254
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ACC44	16_3_00007DF43E2ACC44
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A323C	16_3_00007DF43E2A323C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AC640	16_3_00007DF43E2AC640
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A769C	16_3_00007DF43E2A769C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A36F0	16_3_00007DF43E2A36F0
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AB0B4	16_3_00007DF43E2AB0B4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA328	16_3_00007DF43E2AA328
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B2520	16_3_00007DF43E2B2520
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AFB14	16_3_00007DF43E2AFB14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AFB14	16_3_00007DF43E2AFB14
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AA918	16_3_00007DF43E2AA918
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2ABD10	16_3_00007DF43E2ABD10
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5F68	16_3_00007DF43E2A5F68
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2AAD54	16_3_00007DF43E2AAD54
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B3942	16_3_00007DF43E2B3942
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B3942	16_3_00007DF43E2B3942
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2A5540	16_3_00007DF43E2A5540
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_3_00007DF43E2B392C	16_3_00007DF43E2B392C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D7E5F4	16_2_000001A4F8D7E5F4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D62628	16_2_000001A4F8D62628
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D6C308	16_2_000001A4F8D6C308
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D7340C	16_2_000001A4F8D7340C
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8DA6DF4	16_2_000001A4F8DA6DF4
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D9D5E8	16_2_000001A4F8D9D5E8

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C6B397D appears 37 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C58DC24 appears 65 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C58589B appears 190 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C594396 appears 54 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C58DC4E appears 44 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C582FB3 appears 186 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C585B56 appears 33 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C6A9AF0 appears 45 times
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: String function: 6C614DE0 appears 45 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 508

Source: lumma.exe, 00000000.00000002.1957017064.0000000003E54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exer) vs lumma.exe
Source: lumma.exe, 00000000.00000002.1957017064.0000000003F35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exer) vs lumma.exe
Source: lumma.exe, 00000000.00000002.1962446070.00000000058C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs lumma.exe
Source: lumma.exe, 00000000.00000002.1941756397.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exer) vs lumma.exe
Source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs lumma.exe
Source: lumma.exe, 00000000.00000002.1957017064.0000000003C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs lumma.exe
Source: lumma.exe, 00000000.00000002.1957017064.0000000003E3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJpfuwc.dll" vs lumma.exe
Source: lumma.exe, 00000000.00000002.1959588253.0000000005340000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameJpfuwc.dll" vs lumma.exe
Source: lumma.exe, 00000000.00000000.1699671929.0000000000812000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: get_DiscardOriginalFilename vs lumma.exe
Source: lumma.exe, 00000000.00000000.1699671929.0000000000812000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: set_DiscardOriginalFilename vs lumma.exe
Source: lumma.exe, 00000000.00000000.1699671929.0000000000812000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: get_Codecset_Codecget_BitRateset_BitRateget_Frequencyset_Frequencyget_Channelsset_Channelsget_ChannelLayoutset_ChannelLayoutget_Errorset_Errorget_TopLeftset_TopLeftget_Sizeset_Sizeget_PublicIdsset_PublicIdsget_Customset_Customget_Facesset_Facesget_Deletedset_Deletedget_NextCursorset_NextCursorget_Partialset_Partialget_Messageset_Messageget_Resultset_Resultget_Transformationset_Transformationget_Formatset_Formatget_Lengthset_Lengthget_Idset_Idget_Urlset_Urlget_SecureUrlset_SecureUrlget_RekognitionFaceset_RekognitionFaceget_Uriset_Uriget_SecureUriset_SecureUriset_Typeget_Eagerset_Eagerget_Statusset_Statusget_BatchIdset_BatchIdget_BoundingBoxset_BoundingBoxget_Confidenceset_Confidenceget_Ageset_Ageget_Smileset_Smileget_Glassesset_Glassesget_Sunglassesset_Sunglassesget_Beardset_Beardget_Mustacheset_Mustacheget_EyeClosedset_EyeClosedget_MouthOpenWideset_MouthOpenWideget_Beautyset_Beautyget_Genderset_Genderget_Raceset_Raceget_Emotionset_Emotionget_Qualityset_Qualityget_Poseset_Poseget_EyeLeftPositionset_EyeLeftPositionget_EyeRightPositionset_EyeRightPositionget_EyeLeft_Leftset_EyeLeft_Leftget_EyeLeft_Rightset_EyeLeft_Rightget_EyeLeft_Upset_EyeLeft_Upget_EyeLeft_Downset_EyeLeft_Downget_EyeRight_Leftset_EyeRight_Leftget_EyeRight_Rightset_EyeRight_Rightget_EyeRight_Upset_EyeRight_Upget_EyeRight_Downset_EyeRight_Downget_NosePositionset_NosePositionget_NoseLeftset_NoseLeftget_NoseRightset_NoseRightget_MouthLeftset_MouthLeftget_MouthRightset_MouthRightget_MouthUpset_MouthUpget_MouthDownset_MouthDownget_Nameset_Nameget_Pathset_Pathget_Foldersset_Foldersm_resourceTypeget_PublicIdset_PublicIdget_Versionset_Versionget_Createdset_Createdget_Widthset_Widthget_Heightset_Heightget_Exifset_Exifget_Metadataset_Metadataget_Colorsset_Colorsget_Derivedset_Derivedget_Tagsset_Tagsget_Moderationset_Moderationget_Contextset_Contextget_Phashset_Phashget_Predominantset_Predominantget_Coordinatesset_Coordinatesget_Infoset_Infoget_AccessControlset_AccessControlget_Strictset_Strictget_Usedset_Usedget_Unsignedset_Unsignedget_Settingsset_Settingsget_Xset_Xget_Yset_Yget_DeleteTokenset_DeleteTokenget_Detectionset_Detectionm_resourceTypesget_Resourcesset_Resourcesget_Transformationsset_Transformationsget_Presetsset_PresetsStatusKindResponseUpdatedAtget_Googleset_Googleget_Publishedset_Publishedget_Failedset_Failedget_UploadIdset_UploadIdget_Signatureset_Signatureget_ResourceTypeset_ResourceTypeget_CreatedAtset_CreatedAtget_Backupset_Backupget_ModerationStatusset_ModerationStatusImageget_TotalCountset_TotalCountget_Timeset_Timeget_CssUriset_CssUriget_SecureCssUriset_SecureCssUriget_ImageUriset_ImageUriget_JsonUriset_JsonUriget_ImageInfosset_ImageInfosget_Updatedset_Updatedget_DisallowPublicIdset_DisallowPublicIdget_Invalidateset_Invalidateget_UseFilenameset_UseFilenameget_UniqueFilenameset_UniqueFilenameget_DiscardOriginalFilenameset_DiscardOriginalFilenameget_NotificationUrlset_NotificationUrlget_Proxyset_Proxyget_Folderset_Folderget_Overwriteset_Overwriteget_RawConvertset_RawConvertg
Source: lumma.exe, 00000000.00000000.1699671929.0000000000812000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: DiscardOriginalFilename vs lumma.exe
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs lumma.exe
Source: lumma.exe, 00000000.00000002.1941035062.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lumma.exe
Source: lumma.exe, 00000000.00000002.1957017064.0000000003DD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs lumma.exe
Source: lumma.exe, 00000000.00000000.1700133058.0000000000994000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRick.exeF vs lumma.exe

Source: lumma.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: lumma.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.lumma.exe.58c0000.8.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@41/2@12/15

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C58C9A2 GetLastError,SetLastError,FormatMessageW,GetLastError,SetLastError,LocalFree,

24_2_6C58C9A2

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C58F3BF GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

24_2_6C58F3BF

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,		24_2_6C597EA9
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,		24_2_6C597B61

Source: C:\Windows\System32\svchost.exe

Code function: 11_2_00007DF464D6286C CreateToolhelp32Snapshot,Thread32First,Thread32Next,CloseHandle,SuspendThread,

11_2_00007DF464D6286C

Source: C:\Program Files\Windows Media Player\wmlaunch.exe

Code function: 16_3_00007DF43E2A147C CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VirtualProtect,VirtualProtect,CoUninitialize,

16_3_00007DF43E2A147C

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_00A46329 LoadResource,LockResource,SizeofResource,

24_2_00A46329

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C596F73 OpenSCManagerW,OpenServiceW,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,

24_2_6C596F73

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5975C3 StartServiceCtrlDispatcherW,GetLastError,WaitForSingleObject,CloseHandle,		24_2_6C5975C3
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C597667 StartServiceCtrlDispatcherW,GetLastError,WaitForSingleObject,CloseHandle,		24_2_6C597667

Source: C:\Program Files\Windows Media Player\wmlaunch.exe

File created: C:\Users\user\AppData\Roaming\Avt

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\GS-1-5-21-2246122658-3693405117-2476756634-1002{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:64:WilError_03
Source: C:\Users\user\Desktop\lumma.exe	Mutant created: \Sessions\1\BaseNamedObjects\Tdhwzhgyj
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-e7bff43-f59e-86fde9-5b63c7129879}
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-b634f2b7-3877-b1c5bf-de8588539928}

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\153043d0-f427-49a4-9bf7-1d93aeb20630

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Command line argument: kernel32.dll		24_2_00A46A08
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Command line argument: DllEntry		24_2_00A46A08

Source: lumma.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: lumma.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\lumma.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: chrome.exe, 0000000C.00000002.2195449795.0000021E4F5E0000.00000002.00000001.00040000.00000010.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: svchost.exe, 0000000B.00000003.2190065643.000001AAC05F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2189920296.000001AAC0F38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2190008769.000001AAC0F38000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2195838335.0000021E4F615000.00000002.00000001.00040000.00000013.sdmp, chrome.exe, 0000000C.00000003.2166197032.00002FB00069C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: svchost.exe, 0000000B.00000003.2091757020.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2090607098.000001AAC4010000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433965471.000001AAC4550000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2439143472.00007DF464E91000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2433494890.000001AAC43D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: lumma.exe	Virustotal: Detection: 46%
Source: lumma.exe	ReversingLabs: Detection: 42%

Source: AvastBrowserUpdate.exe	String found in binary or memory: /installerdata=
Source: AvastBrowserUpdate.exe	String found in binary or memory: https://www.google.com/support/installer/?
Source: AvastBrowserUpdate.exe	String found in binary or memory: Application update/install

Source: unknown	Process created: C:\Users\user\Desktop\lumma.exe "C:\Users\user\Desktop\lumma.exe"
Source: C:\Users\user\Desktop\lumma.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 508
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chrF5B6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2036,i,347058465105131194,15016931794279855737,262144 /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmlaunch.exe "C:\Program Files\Windows Media Player\wmlaunch.exe"
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chrA791.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/c1ff4a97/4a1b3c1a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2356,i,6262889531060732186,15388988117095417937,262144 /prefetch:8
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Users\user\Desktop\lumma.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chrF5B6.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmlaunch.exe "C:\Program Files\Windows Media Player\wmlaunch.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2036,i,347058465105131194,15016931794279855737,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe --user-data-dir="C:\Users\user\AppData\Local\Temp\chrA791.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/c1ff4a97/4a1b3c1a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2356,i,6262889531060732186,15388988117095417937,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\lumma.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll

Source: C:\Users\user\Desktop\lumma.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\lumma.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: lumma.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: lumma.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: lumma.exe

Static file information: File size 1580032 > 1048576

Source: lumma.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x181000

Source: lumma.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: svchost.exe, 00000007.00000003.1970795284.0000000000D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970883004.0000000004E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1971429702.0000000004FB0000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: lumma.exe, 00000000.00000002.1962446070.00000000058C0000.00000004.08000000.00040000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003DD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: svchost.exe, 00000007.00000003.1970126231.0000000004F80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1969928728.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2415573190.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000007.00000003.1970575295.0000000004F30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970404014.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2416164043.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: svchost.exe, 00000007.00000003.1970126231.0000000004F80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1969928728.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2415573190.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: lumma.exe, 00000000.00000002.1962446070.00000000058C0000.00000004.08000000.00040000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, lumma.exe, 00000000.00000002.1957017064.0000000003DD3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, 00000007.00000003.1970575295.0000000004F30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970404014.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2416164043.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmlaunch.exe, wmlaunch.exe, 00000010.00000003.2314246638.000001A4F8F30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2314293957.000001A4F9080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: AvastBrowserUpdate_unsigned.pdb source: wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp, AvastBrowserUpdate.exe, AvastBrowserUpdate.exe, 00000018.00000000.2385120400.0000000000A41000.00000020.00000001.01000000.00000022.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: svchost.exe, 00000007.00000003.1971085949.0000000004D90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1971429702.0000000004FB0000.00000004.00000001.00020000.00000000.sdmp, AvastBrowserUpdate.exe, 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: svchost.exe, 00000007.00000003.1970795284.0000000000D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1970883004.0000000004E10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmlaunch.exe, 00000010.00000003.2314246638.000001A4F8F30000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2314293957.000001A4F9080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: TEST_goopdate_unsigned.pdb source: wmlaunch.exe, 00000010.00000003.2784967822.000001A4FB970000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376090447.000001A4FB972000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: lumma.exe, --.cs	.Net Code: _000E System.AppDomain.Load(byte[])
Source: lumma.exe, ---.cs	.Net Code: _000E
Source: 0.2.lumma.exe.5840000.7.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.lumma.exe.5840000.7.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.lumma.exe.5840000.7.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.lumma.exe.5840000.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.lumma.exe.5840000.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.lumma.exe.58c0000.8.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.lumma.exe.3dd39d8.1.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.lumma.exe.57c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lumma.exe.57c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1961637127.00000000057C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lumma.exe PID: 6844, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C69447A CloseHandle,InitializeCriticalSection,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,__set_purecall_handler,LeaveCriticalSection,

24_2_6C69447A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A525D push es; ret	6_2_025A5264
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A2C39 push ecx; ret	6_2_025A2C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A10F9 push FFFFFF82h; iretd	6_2_025A10FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A44F9 push edx; retf	6_2_025A44FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A28EC push edi; ret	6_2_025A28F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A4D5E push esi; ret	6_2_025A4D69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A0F6A push eax; ret	6_2_025A0F75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A21DC push eax; ret	6_2_025A21DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A3FD4 push ss; retf	6_2_025A3FF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A3F89 push edi; iretd	6_2_025A3F96
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B225C push eax; ret	7_3_006B225D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B4054 push ss; retf	7_3_006B4075
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B4009 push edi; iretd	7_3_006B4016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B52DD push es; ret	7_3_006B52E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B2CB9 push ecx; ret	7_3_006B2CD9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B296C push edi; ret	7_3_006B2978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B1179 push FFFFFF82h; iretd	7_3_006B117B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B4579 push edx; retf	7_3_006B457C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B0FEA push eax; ret	7_3_006B0FF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B4DDE push esi; ret	7_3_006B4DE9
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D8A877 push ecx; iretd	11_2_00007DF464D8A878
Source: C:\Windows\System32\dllhost.exe	Code function: 20_2_00000218C4C7028B push edx; ret	20_2_00000218C4C7028C
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_018721DC push eax; ret	24_3_018721DD
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_01874D01 push esi; ret	24_3_01874D6A
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_01870F6A push eax; ret	24_3_01870F75
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_01876E8F push esi; ret	24_3_01876EA1
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_018728EC push edi; ret	24_3_018728F8
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_018742FB push edi; ret	24_3_018742CC
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_018710F9 push FFFFFF82h; iretd	24_3_018710FB
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_01872C39 push ecx; ret	24_3_01872C59
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6A9B36 push ecx; ret	24_2_6C6A9B49

Source: lumma.exe

Static PE information: section name: .text entropy: 7.639579243837958

Source: 0.2.lumma.exe.5340000.4.raw.unpack, LODGbU5p2MTXAtllHIU.cs	High entropy of concatenated method names: 'hNW545ycHR', 'IQL586OImo9yJCvn3k8', 'iOXcM0OsbtmqKT6R4VU', 'zun1abk7DJehePa61Kp', 'IlbsSFkP4GV8WYtD2r5'
Source: 0.2.lumma.exe.5340000.4.raw.unpack, PM1UZs9Q1rMjK8ftf1D.cs	High entropy of concatenated method names: 'i3H9u555fi', 'wC79LSdM1N', 'Ve49AXv7O6', 'vjk9owcWBe', 'ohs9f50xCd', 'BiB91EAaZ6', 'UcG9rsa2bj', 'WmV94vnpEr', 'SFA9HjUW1u', 'ENe9XG3eMy'

Source: C:\Program Files\Windows Media Player\wmlaunch.exe	File created: C:\Users\user\AppData\Roaming\Avt\goopdate.dll			Jump to dropped file
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	File created: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C584222 GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,_wcslen,GetPrivateProfileIntW,

24_2_6C584222

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C688366 OpenSCManagerW,OpenServiceW,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

24_2_6C688366

Source: C:\Program Files\Windows Media Player\wmlaunch.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Program Files\Windows Media Player\wmlaunch.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\avt CfgData

Jump to behavior

Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: lumma.exe PID: 6844, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI			Jump to behavior

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 4F8B83A
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 5AFB83A

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXEAUTORUNS.EXEDUMPCAP.EXEDE4DOT.EXEHOOKEXPLORER.EXEILSPY.EXELORDPE.EXEDNSPY.EXEPETOOLS.EXEAUTORUNSC.EXL
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DDLER.EXEIDA.EXEIDA64.EXEIMMUNITYDEBUGGER.EXEWINDUMP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEP

Source: C:\Users\user\Desktop\lumma.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Memory allocated: 4C60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vboxservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vboxtray.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxMouse.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: VBoxTrayIPC	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxSF.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vboxhook.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDate	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: \pipe\VBoxTrayIPC	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxVideo.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: VBoxMiniRdrDN	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxGuest.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 11_2_00007DF464E64248 sldt word ptr [eax]

11_2_00007DF464E64248

Source: C:\Windows\System32\dllhost.exe

Code function: GetAdaptersInfo,

20_2_00000218C4C72AC4

Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Avt\goopdate.dll			Jump to dropped file
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

API coverage: 5.9 %

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D81618 FindFirstFileW,DeleteFileW,FindNextFileW,RemoveDirectoryW,	11_2_00007DF464D81618
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5B6118 FindFirstFileW,FindClose,FindNextFileW,	24_2_6C5B6118
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5878C0 FindFirstFileW,GetLastError,_wcslen,DeleteFileW,FindNextFileW,GetLastError,FindClose,	24_2_6C5878C0
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C587A07 GetFileAttributesW,GetLastError,_wcslen,FindFirstFileW,GetLastError,_wcslen,_wcslen,FindNextFileW,FindClose,RemoveDirectoryW,	24_2_6C587A07
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5A944D FindFirstFileW,FindNextFileW,FindClose,	24_2_6C5A944D
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C589507 FindFirstFileW,FindNextFileW,FindClose,	24_2_6C589507
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C58D6DE FindFirstFileW,FindNextFileW,FindClose,	24_2_6C58D6DE
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C587789 FindFirstFileW,FindNextFileW,GetLastError,FindClose,	24_2_6C587789
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C5C92EE FindFirstFileW,GetLastError,PathStripPathW,PathStripPathW,PathStripPathW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,FindNextFileW,GetLastError,FindClose,	24_2_6C5C92EE

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C591FC7 GetLogicalDriveStringsW,QueryDosDeviceW,_wcslen,_wcslen,

24_2_6C591FC7

Source: C:\Windows\System32\svchost.exe

Code function: 11_2_00007DF464D62514 GetSystemInfo,

11_2_00007DF464D62514

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: svchost.exe, 00000007.00000003.1991983379.0000000000813000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\viostorsi Bus 0\Target Id 0\Logical Unit Id 011D2-B604-00104B703EFD}104B703EFD}\ProxyStubClsid32\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Toolssses\WOW6432Node\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\REGISTRY\USER\S-1-5-21-2246122658-3693405117-2476756634-1002_Clas\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools
Source: chrome.exe, 0000000C.00000002.2193677559.0000021E49A0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~~g
Source: svchost.exe, 00000007.00000003.1995639915.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1993014014.0000000000A71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1995529908.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1994914913.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1993961495.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1995022702.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1993157358.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1993488677.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1993396449.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1993283334.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2044424258.0000000000A6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 00000007.00000002.2044655088.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JMicrosoft-Windows-Fault-Tolerant-HeapHMicrosoft-Antimalware-ShieldProviderFApplication Management Group PolicyDMicrosoft-Windows-BitLocker-DriverHMicrosoft-Windows-Devices-Background>Microsoft-Windows-BitLocker-API>Microsoft-Windows-DHCPv6-Client@Microsoft-Windows-DistributedCOM@Microsoft-Windows-EventCollector@Microsoft-Windows-DiskDiagnostic@Microsoft-Windows-WMPNSS-Service>Microsoft-Windows-FilterManagerJMicrosoft-Windows-GPIO-ClassExtensionHMicrosoft-Windows-Hyper-V-HypervisorBMicrosoft-Windows-WLAN-AutoConfigDMicrosoft-Windows-IsolatedUserMode<Microsoft-Windows-OfflineFiles@Microsoft-Windows-Spell-Checking<Microsoft-Windows-Kernel-Power>Microsoft-Windows-TaskScheduler@Microsoft-Windows-Kernel-General<Microsoft-Windows-Time-Service<Microsoft-Windows-SpellCheckerJMicrosoft-Windows-ResourcePublicationHMicrosoft-Windows-SPB-ClassExtensionFMicrosoft-Windows-LanguagePackSetup>Microsoft-Windows-USB-MAUSBHOST>Microsoft-Windows-OverlayFilter>Microsoft-Windows-SetupPlatform>Microsoft-Windows-StartupRepair>Microsoft-Windows-NetworkBridgeJMicrosoft-Windows-Power-Meter-PollingJMicrosoft-Windows-WindowsUpdateClientBMicrosoft-Windows-WLAN-AutoConfig
Source: svchost.exe, 00000007.00000002.2044265505.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(<
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: AvastBrowserUpdate.exe, 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: svchost.exe, 00000007.00000002.2044211264.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2436384831.000001AAC0413000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000002.2966487125.000001A4F8F87000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000014.00000002.2764857606.00000218C4E8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.2044424258.0000000000A5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\wbem\fastprox.dlll@Microsoft-Windows-DiskDiagnosticlll@Microsoft-Windows-EventCollector.dll>Microsoft-Windows-FilterManagerx.dllC:\Windows\system32\wbem\fastprox.dlllHMicrosoft-Windows-Hyper-V-HypervisorC:\Windows\system32\wbem\wbemsvc.dlll
Source: lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: wmlaunch.exe, 00000010.00000002.2966487125.000001A4F8F87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: svchost.exe, 00000007.00000002.2044424258.0000000000A6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ConfigMicrosoft-Windows-CoreSystem-NetProvision-JoinProviderOnlineMicrosoft-Windows-CorruptedFileRecovery-ClientMicrosoft-Windows-CorruptedFileRecovery-ServerMicrosoft-Windows-Devices-BackgroundMicrosoft-Windows-DfsSvcMicrosoft-Windows-Dhcp-ClientMicrosoft-Windows-DHCPv6-ClientMicrosoft-Windows-Diagnostics-NetworkingMicrosoft-Windows-Directory-Services-SAMMicrosoft-Windows-DiskDiagnosticMicrosoft-Windows-DistributedCOMMicrosoft-Windows-DNS-ClientMicrosoft-Windows-DriverFrameworks-UHyper-V RAWws-EnhancedStorage-EhStorTcgDrvMicrosoft-Windows-EventCollectorMicrosoft-Windows-EventlogMicrosoft-Windows-exFAT-SQMMicrosoft-Windows-FailoverClustering-ClientMicrosoft-Windows-Fat-SQMMicrosoft-Windows-Fault-Tolerant-HeapMicrosoft-Windows-FilterManagerMicrosoft-Windows-FirewallMicrosoft-Windows-FMSMicrosoft-Windows-FunctionDiscoveryHostMicrosoft-Windows-GPIO-ClassExtensionMicrosoft-Windows-GroupPolicyMicrosoft-Windows-HALMicrosoft-Windows-HttpEventMicrosoft-Windows-HttpServiceMicrosoft-Windows-Hyper-V-HypervisorMicrosoft-Windows-IphlpsvcMicrosoft-Windows-IsolatedUserModeMicrosoft-Windows-Kernel-BootMicrosoft-Windows-Kernel-GeneralMicrosoft-Windows-Kernel-Interrupt-SteeringMicrosoft-Windows-Kernel-IOMicrosoft-Windows-Kernel-PnPMicrosoft-Windows-Kernel-PowerMicrosoft-Windows-Kernel-Processor-PowerMicrosoft-Windows-Kernel-TmMicrosoft-Windows-Kernel-WHEAMicrosoft-Windows-Kernel-XDVMicrosoft-Windows-LanguagePackSetupMicrosoft-Windows-Memory-Diagnostic-Task-HandlerMicrosoft-Windows-MemoryDiagnostics-ResultsMicrosoft-Windows-MemoryDiagnostics-ScheduleMicrosoft-Windows-MountMgrMicrosoft-Windows-NDISMicrosoft-Windows-NdisImPlatformSysEvtProviderMicrosoft-Windows-NetworkBridgeMicrosoft-Windows-NtfsMicrosoft-Windows-Ntfs-UBPMMicrosoft-Windows-OfflineFilesMicrosoft-Windows-OverlayFilterMicrosoft-Windows-PersistentMemory-NvdimmMicrosoft-Windows-PersistentMemory-PmemDiskMicrosoft-Windows-Power-Meter-PollingMicrosoft-Windows-Power-TroubleshooterMicrosoft-Windows-ReFSMicrosoft-Windows-ReFS-v1Microsoft-Windows-ResetEngMicrosoft-Windows-Resource-Exhaustion-DetectorMicrosoft-Windows-ResourcePublicationMicrosoft-Windows-SCPNPMicrosoft-Windows-Serial-ClassExtensionMicrosoft-Windows-Serial-ClassExtension-V2Microsoft-Windows-ServicingMicrosoft-Windows-SetupMicrosoft-Windows-SetupPlatformMicrosoft-Windows-SPB-ClassExtensionMicrosoft-Windows-SPB-HIDI2CMicrosoft-Windows-Spell-CheckingMicrosoft-Windows-SpellCheckerMicrosoft-Windows-StartupRepairMicrosoft-Windows-Subsys-SMSSMicrosoft-Windows-TaskSchedulerMicrosoft-Windows-TerminalServices-LocalSessionManagerMicrosoft-Windows-TerminalServices-RemoteConnectionManagerMicrosoft-Windows-Time-ServiceMicrosoft-Windows-TPM-WMIMicrosoft-Windows-USB-CCIDMicrosoft-Windows-USB-MAUSBHOSTMicrosoft-Windows-USB-USBHUB3Microsoft-Windows-USB-USBXHCIMicrosoft-Windows-UserModePowerServiceMicrosoft-Windows-UserPnpMicrosoft-Windows-WHEA-LoggerMicrosoft-Windows-Windows Firewall With Advanced SecurityMicrosoft-Windows-WindowsToGo-StartupOptionsMicrosoft-Window
Source: lumma.exe, 00000000.00000002.1961022357.000000000568D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
Source: AvastBrowserUpdate.exe, 00000018.00000003.2417150589.0000000004190000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: svchost.exe, 0000000B.00000002.2436384831.000001AAC0413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@8C

Source: C:\Users\user\Desktop\lumma.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 6_2_025A02CC VirtualAlloc,VirtualAlloc,VirtualProtect,LdrInitializeThunk,VirtualFree,

6_2_025A02CC

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_00A470C0 IsDebuggerPresent,OutputDebugStringW,

24_2_00A470C0

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

24_2_6C69447A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_025A0277 mov eax, dword ptr fs:[00000030h]	6_2_025A0277
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_3_006B0283 mov eax, dword ptr fs:[00000030h]	7_3_006B0283
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_3_01870277 mov eax, dword ptr fs:[00000030h]	24_3_01870277
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_00A4BE58 mov eax, dword ptr fs:[00000030h]	24_2_00A4BE58
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_00A4A765 mov eax, dword ptr fs:[00000030h]	24_2_00A4A765
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6B6064 mov eax, dword ptr fs:[00000030h]	24_2_6C6B6064
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6CB4BF mov esi, dword ptr fs:[00000030h]	24_2_6C6CB4BF
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_01337BBC mov eax, dword ptr fs:[00000030h]	24_2_01337BBC
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_03D601F1 mov eax, dword ptr fs:[00000030h]	24_2_03D601F1

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_00A4643F GetProcessHeap,__Init_thread_footer,__Init_thread_footer,

24_2_00A4643F

Source: C:\Users\user\Desktop\lumma.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_00A47878 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00A47878
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_00A4799A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00A4799A
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_00A4A14C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_00A4A14C
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_00A47B31 SetUnhandledExceptionFilter,	24_2_00A47B31
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C69447A CloseHandle,InitializeCriticalSection,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,__set_purecall_handler,LeaveCriticalSection,	24_2_6C69447A
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C694720 FreeLibrary,FreeLibrary,FreeLibrary,EnterCriticalSection,SetUnhandledExceptionFilter,__set_purecall_handler,_Deallocate,LeaveCriticalSection,DeleteCriticalSection,ReleaseSemaphore,WaitForSingleObject,CloseHandle,CloseHandle,DeleteCriticalSection,CloseHandle,CloseHandle,DeleteCriticalSection,	24_2_6C694720
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C694943 EnterCriticalSection,SetUnhandledExceptionFilter,__set_purecall_handler,	24_2_6C694943
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6949B0 SetUnhandledExceptionFilter,__set_purecall_handler,LeaveCriticalSection,	24_2_6C6949B0
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6A99CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_6C6A99CC
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6AFB98 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_6C6AFB98
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: 24_2_6C6A9602 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_6C6A9602

Source: C:\Users\user\Desktop\lumma.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 91.240.118.2 9769

Jump to behavior

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 218C4C70000 protect: page read and write			Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 17479CA0000 protect: page read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory written: C:\Windows\System32\dllhost.exe base: 218C4C70000	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF70F3314E0	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory written: C:\Windows\System32\dllhost.exe base: 17479CA0000	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF70F3314E0	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C588139 SetForegroundWindow,ShellExecuteExW,AllowSetForegroundWindow,GetLastError,GetLastError,DestroyWindow,SetLastError,

24_2_6C588139

Source: C:\Users\user\Desktop\lumma.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Media Player\wmlaunch.exe "C:\Program Files\Windows Media Player\wmlaunch.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C5866A9 GetSecurityDescriptorDacl,SetSecurityDescriptorDacl,

24_2_6C5866A9

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C590E06 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

24_2_6C590E06

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_00A47B9B cpuid

24_2_00A47B9B

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	24_2_6C6C8030
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetLocaleInfoW,	24_2_6C6C7D33
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	24_2_6C6C7E5C
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetLocaleInfoW,	24_2_6C6C7F63
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetLocaleInfoW,	24_2_6C6C78C7
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: EnumSystemLocalesW,	24_2_6C6C7970
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: EnumSystemLocalesW,	24_2_6C6C79BB
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: EnumSystemLocalesW,	24_2_6C6C7A56
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	24_2_6C6C7AE3
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	24_2_6C6C76F8
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: GetLocaleInfoW,	24_2_6C6BF76D
Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe	Code function: EnumSystemLocalesW,	24_2_6C6BF1F6

Source: C:\Users\user\Desktop\lumma.exe	Queries volume information: C:\Users\user\Desktop\lumma.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lumma.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\svchost.exe

Code function: 11_2_00007DF464D86448 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

11_2_00007DF464D86448

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_00A47DC5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

24_2_00A47DC5

Source: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Code function: 24_2_6C635D91 GetVersionExW,GetLastError,_wcslen,

24_2_6C635D91

Source: C:\Users\user\Desktop\lumma.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: svchost.exe, 00000007.00000002.2044701320.0000000000B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autoruns.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000018.00000003.2414381682.0000000001880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2422321579.0000000003D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2499439978.0000000003880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1957104876.0000000002790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2045084480.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1952419191.00000000007F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2419272459.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: svchost.exe, 0000000B.00000003.2189735078.000001AAC0CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: !CP:Defichain-Electrum
Source: svchost.exe, 0000000B.00000003.2189735078.000001AAC0CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\ElectronCash\config
Source: svchost.exe, 0000000B.00000002.2436643674.000001AAC04AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\com.liberty.jaxx
Source: svchost.exe, 0000000B.00000003.2189735078.000001AAC0CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: svchost.exe, 0000000B.00000003.2189735078.000001AAC0CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Exodus
Source: svchost.exe, 0000000B.00000003.2189735078.000001AAC0CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets
Source: lumma.exe, 00000000.00000002.1959588253.0000000005340000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: svchost.exe, 0000000B.00000002.2436643674.000001AAC04A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000018.00000003.2414381682.0000000001880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2422321579.0000000003D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2499439978.0000000003880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1957104876.0000000002790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2045084480.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1952419191.00000000007F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2419272459.00000000033F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\svchost.exe	Code function: 11_2_00007DF464D86448 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		11_2_00007DF464D86448
Source: C:\Program Files\Windows Media Player\wmlaunch.exe	Code function: 16_2_000001A4F8D6D070 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		16_2_000001A4F8D6D070

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	31 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	13 File and Directory Discovery	Remote Desktop Protocol	21 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Valid Accounts	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	256 System Information Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	14 Windows Service	1 Valid Accounts	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Service Execution	11 Scheduled Task/Job	11 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	661 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	14 Windows Service	1 Extra Window Memory Injection	Cached Domain Credentials	25 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	312 Process Injection	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	25 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	312 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lumma.exe	46%	Virustotal		Browse
lumma.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Cassiopeia

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Avt\goopdate.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f	0%	Avira URL Cloud	safe
http://anglebug.com/6876K	0%	Avira URL Cloud	safe
http://anglebug.com/67554	0%	Avira URL Cloud	safe
http://127.0.0.1:%u/json/list?t=%u	0%	Avira URL Cloud	safe
http://127.01:	0%	Avira URL Cloud	safe
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1append	0%	Avira URL Cloud	safe
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a	0%	Avira URL Cloud	safe
http://anglebug.com/2970M	0%	Avira URL Cloud	safe
https://anglebug.com/72467	0%	Avira URL Cloud	safe
http://anglebug.com/3498J	0%	Avira URL Cloud	safe
http://127.0.0.1/	0%	Avira URL Cloud	safe
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1ayPolicy	0%	Avira URL Cloud	safe
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1aination	0%	Avira URL Cloud	safe
https://ovalre.us	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gbg1.ntp.netnod.se	194.58.203.20	true	false	high
x.ns.gin.ntt.net	129.250.35.250	true	false	high
ovalre.us	188.114.97.3	true	false	unknown
time.google.com	216.239.35.12	true	false	high
twc.trafficmanager.net	20.101.57.9	true	false	high
ntp.time.nl	94.198.159.14	true	false	high
ntp.time.in.ua	62.149.0.30	true	false	high
time-a-g.nist.gov	129.6.15.28	true	false	high
ts1.aco.net	193.171.23.163	true	false	unknown
time.facebook.com	129.134.29.123	true	false	high
ipv4.imgur.map.fastly.net	199.232.196.193	true	false	high
ntp1.hetzner.de	213.239.239.164	true	false	high
gbg1.ntp.se	unknown	unknown	false	high
i.imgur.com	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://91.240.118.2:9769/78fc5131525a9e8d335b1/asba3xl7.v343f	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 0000000C.00000002.2196783250.00002FB000084000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	lumma.exe, 00000000.00000002.1961022357.000000000568D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1a	chrome.exe, 0000000C.00000002.2204803352.000034C400238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199802841.00002FB0006C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201439544.00002FB0009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200176301.00002FB000774000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2204929620.000034C400264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201691011.00002FB000A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201488104.00002FB000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201081648.00002FB000964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2207794024.0000661400238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 0000000C.00000002.2200062575.00002FB000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198337438.00002FB000474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6876K	chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico.	chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/72467	chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7714	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 0000000C.00000002.2201081648.00002FB000964000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 0000000C.00000002.2201053420.00002FB000954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/67554	chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2970M	chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/255411748	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 0000000C.00000002.2198298913.00002FB000444000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200249285.00002FB0007A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200215069.00002FB000790000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com	svchost.exe, 0000000B.00000003.2217055485.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2198859150.000001AAC05F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:%u/json/list?t=%u	wmlaunch.exe, 00000010.00000003.2755170678.00007DF43E2AD000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2354997200.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2348107704.000001A4F8FC2000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000002.2968680582.00007DF43E2DD000.00000004.00000001.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2355272642.000001A4F904B000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2348233895.000001A4F902A000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2755310403.000001A4FB061000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp, lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 0000000C.00000002.2200521741.00002FB000844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icoBA8	chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1append	chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.01:	svchost.exe, 0000000B.00000003.2222031616.000001AAC0C12000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 0000000C.00000002.2200134575.00002FB000734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198397887.00002FB000490000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 0000000C.00000002.2198337438.00002FB000474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3498J	chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5371	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2164468965.00002FB0001B8000.00000004.00000800.00020000.00000000.sdmp, AvastBrowserUpdate.exe	false		high
http://developer.chrome.com/extensions/external_extensions.html)	chrome.exe, 0000000C.00000002.2196992568.00002FB0000EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 0000000C.00000002.2200134575.00002FB000734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198397887.00002FB000490000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1/	chrome.exe, 0000000C.00000002.2197135422.00002FB00014C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2199188707.00002FB000590000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201439544.00002FB0009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198638874.00002FB000530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2196753198.00002FB000078000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7556	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 0000000C.00000002.2196608780.00002FB00000C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	svchost.exe, 0000000B.00000003.2190579685.000001AAC0E46000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 0000000C.00000002.2197322167.00002FB0001AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/a	chrome.exe, 0000000C.00000002.2201081648.00002FB000964000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en-GB	chrome.exe, 0000000C.00000002.2200521741.00002FB000844000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000000C.00000002.2203370226.00002FB000CC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2197609580.00002FB0002A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2188423161.00002FB000CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2201655612.00002FB000A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 0000000C.00000002.2202550769.00002FB000BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients5.google.com/tbproxy/usagestats	AvastBrowserUpdate.exe	false		high
http://www.avast.com0/	wmlaunch.exe, 00000010.00000003.2782225949.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373603547.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782662060.000001A4FAEEE000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2785255054.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2373898538.000001A4FAA41000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2376442849.000001A4FAA42000.00000004.00000020.00020000.00000000.sdmp, wmlaunch.exe, 00000010.00000003.2782048762.000001A4FB5B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en-GB~p	chrome.exe, 0000000C.00000002.2199935061.00002FB000707000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4384	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1ayPolicy	chrome.exe, 0000000C.00000002.2200176301.00002FB000774000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW	chrome.exe, 0000000C.00000002.2200062575.00002FB000724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198337438.00002FB000474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2200291387.00002FB0007C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ovalre.us	lumma.exe, 00000000.00000002.1941756397.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs	chrome.exe, 0000000C.00000002.2200898180.00002FB0008DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7604	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7761	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7760	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	svchost.exe, 0000000B.00000003.2188542611.000001AAC0F2A000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198268258.00002FB000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2198766447.00002FB00055C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5901	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6439	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7406	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.icocStateWorks	chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	lumma.exe, 00000000.00000002.1962186457.0000000005840000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.google.com/support/installer/?	AvastBrowserUpdate.exe	false		high
http://anglebug.com/5906	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	chrome.exe, 0000000C.00000003.2178360924.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187762315.00002FB000760000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202104947.00002FB000B9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:8000/dcf7ac3d/4a1b3c1aination	chrome.exe, 0000000C.00000002.2204161883.00002FB000D98000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/166809097	chrome.exe, 0000000C.00000003.2187712454.00002FB000380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000C.00000002.2202853580.00002FB000C1C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.58.203.20	gbg1.ntp.netnod.se	Sweden	57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false
213.239.239.164	ntp1.hetzner.de	Germany	24940	HETZNER-ASDE	false
94.198.159.14	ntp.time.nl	Netherlands	1140	SIDNNL	false
20.101.57.9	twc.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
62.149.0.30	ntp.time.in.ua	Ukraine	15497	COLOCALLInternetDataCenterColoCALLUA	false
129.6.15.28	time-a-g.nist.gov	United States	49	US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	false
129.250.35.250	x.ns.gin.ntt.net	United States	2914	NTT-COMMUNICATIONS-2914US	false
193.171.23.163	ts1.aco.net	Austria	1853	ACONETACOnetBackboneAT	false
216.239.35.12	time.google.com	United States	15169	GOOGLEUS	false
199.232.196.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
91.240.118.2	unknown	unknown	49453	GLOBALLAYERNL	true
188.114.97.3	ovalre.us	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
129.134.29.123	time.facebook.com	United States	32934	FACEBOOKUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1629159
Start date and time:	2025-03-04 12:45:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lumma.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@41/2@12/15
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 72% Number of executed functions: 329 Number of non-executed functions: 101
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 17.253.14.253, 17.253.52.253, 17.253.14.125, 172.217.18.3, 142.250.185.110, 74.125.133.84, 5.45.104.115, 144.91.126.59, 131.188.3.221, 131.234.220.231, 142.250.185.227, 142.250.185.142, 74.125.71.84, 52.149.20.212, 23.60.203.209, 20.190.160.64, 13.107.253.72, 20.223.35.26, 2.19.122.7
Excluded domains from analysis (whitelisted): www.bing.com, pool.ntp.org, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, time.apple.com, ctldl.windowsupdate.com, tse1.mm.bing.net, clientservices.googleapis.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, login.live.com, time.g.aaplimg.com, clients.l.google.com
Execution Graph export aborted for target lumma.exe, PID 6844 because it is empty
Execution Graph export aborted for target svchost.exe, PID 4820 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:47:17	API Interceptor	1x Sleep call for process: wmlaunch.exe modified
11:47:23	Task Scheduler	Run new task: AvUpdateTask path: C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.58.203.20	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse
	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse
213.239.239.164	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse
	SecuriteInfo.com.Win64.Evo-gen.13578.12741.exe	Get hash	malicious	RHADAMANTHYS	Browse
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
94.198.159.14	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
20.101.57.9	qqJF9wvlkt.exe	Get hash	malicious	Unknown	Browse
	ChromeSetup.msi	Get hash	malicious	Unknown	Browse
	guwiolw-meislZVVq.exe	Get hash	malicious	MicroClip	Browse
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse
	TSWY.ps1	Get hash	malicious	RHADAMANTHYS	Browse
	p.exe	Get hash	malicious	MeshAgent	Browse
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse
	fmR6erSMao.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse
	NKtd6GRqI1.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gbg1.ntp.netnod.se	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	194.58.203.20
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	194.58.203.20
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse	194.58.203.20
	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	Dr63BNDQN1.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	test.zip	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
twc.trafficmanager.net	32pEpLcFHi.exe	Get hash	malicious	Unknown	Browse	104.40.149.189
	SWIFT.pif.exe	Get hash	malicious	Remcos	Browse	104.40.149.189
	svchost.exe	Get hash	malicious	XWorm	Browse	51.145.123.29
	Model - 2024 - Azure Model Template 3.26.xlsm	Get hash	malicious	Unknown	Browse	104.40.149.189
	SecuriteInfo.com.Other.Malware-gen.10169.30262.xlsx	Get hash	malicious	Unknown	Browse	20.101.57.9
	soft.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse	104.40.149.189
	dld1.dd.exe	Get hash	malicious	Unknown	Browse	104.40.149.189
	Wave.exe	Get hash	malicious	Stealc	Browse	104.40.149.189
	185.7.214.211.exe	Get hash	malicious	XWorm	Browse	104.40.149.189
	Anaconda Powershell Prompt (anaconda3).lnk	Get hash	malicious	Unknown	Browse	104.40.149.189
x.ns.gin.ntt.net	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	129.250.35.250
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	129.250.35.250
	Mansion_setup.exe	Get hash	malicious	Unknown	Browse	129.250.35.250
	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	129.250.35.250
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	129.250.35.250
	TSWY.ps1	Get hash	malicious	RHADAMANTHYS	Browse	129.250.35.250
	SecuriteInfo.com.Win64.Evo-gen.13578.12741.exe	Get hash	malicious	RHADAMANTHYS	Browse	129.250.35.250
	Dr63BNDQN1.dll	Get hash	malicious	RHADAMANTHYS	Browse	129.250.35.250
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	129.250.35.250
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	129.250.35.250

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	194.58.203.20
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	194.58.203.20
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse	194.58.203.20
	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse	194.58.203.20
SIDNNL	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	94.198.159.14
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse	94.198.159.10
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	94.198.159.14
	9L8hmE8xM5.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	New V1.0.4.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.14
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.198.159.10
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	94.198.159.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	na.elf	Get hash	malicious	Mirai, Moobot	Browse	148.7.141.211
	https://email.safetyculture.io/ls/click?upn=u001.3DqD6NmrqMaMkfJRTePo8RnHbF3OwbBaexU29V9qHjNj4TOBBoiwxm7toRGoPg-2FlHj0LYz2tVpiDCJ1QeGEvi9iK8qHSttCpVB0CX-2F4AZlY-3Dw7Pn_-2BFMYDOI23U0aYB2-2BPQMQCaPpRF4RvBTKM5CABJSwssfrO65dvV6AP0uErIUztJpqLYw66g0rRVwHCJqf3VV0z1oLCgH1Eg8RNMG6zOlFc4U7oaz0gakJfxGddcucaT0Lu9cPwJhFnBsehrQgBo25agZBibfXi0xJhtGBOr2g-2FAeT-2BqO6kAZsMn3fk-2FhFI-2BrYUE0xkits6P6Mb3JoHwjNworO1mSI9l4RpVd56NWBI1irE2oSoaiPrhAoP74QaGBF3lNEDqOH90DbunRAfenQtIh0-2B-2BZa3avAfMxXOafQc1BvyIVuXq5496JR66De0iBLXp8urmAvI596zrh3-2FMuz6Q-3D-3D	Get hash	malicious	PayPal Phisher	Browse	150.171.27.10
	2raqmphRKT.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	40.69.146.102
	SWIFT.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	SWIFT.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	AW New Order 2025-01 S238996.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	AW New Order 2025-01 S238996.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	March 2025_Order.xls	Get hash	malicious	Unknown	Browse	13.107.253.42
	SWT- BT-GJ21001.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	AW New Order 2025-01 S238996.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
HETZNER-ASDE	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	SWIFT.xls	Get hash	malicious	Unknown	Browse	5.161.200.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	morninghtaaaafilex.hta	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	AI_25_46416_418811192810.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	rPurchaseOrder-25-1201.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Verger Doc.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	citibank_feb_2025.lnk	Get hash	malicious	Unknown	Browse	188.114.97.3
	awb_post_dhl_delivery_documents_04_03_2025_0000000000025.vbs	Get hash	malicious	GuLoader, Remcos	Browse	188.114.97.3
	DHL%20-%20NINGBO%20OVERDUE%20INVOICES.exe	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	awb_post_dhl_delivery_documents_04_03_2025_0000000000025.vbs	Get hash	malicious	GuLoader	Browse	188.114.97.3
	FSK25-043 FSKOREA(pdf).vbs	Get hash	malicious	Unknown	Browse	188.114.97.3
	FSK25-043 FSKOREA(pdf).vbs	Get hash	malicious	Unknown	Browse	188.114.97.3
caec7ddf6889590d999d7ca1b76373b6	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	91.240.118.2
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	91.240.118.2
	FAIRSAFE_setup.exe	Get hash	malicious	Unknown	Browse	91.240.118.2
	Mansion_setup.exe	Get hash	malicious	Unknown	Browse	91.240.118.2
	Mansion_setup (1).exe	Get hash	malicious	Unknown	Browse	91.240.118.2
	Faersafe_setup.exe	Get hash	malicious	Unknown	Browse	91.240.118.2
	NE00MYCOPc.dll	Get hash	malicious	RHADAMANTHYS	Browse	91.240.118.2
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	91.240.118.2
	6O57pKpDUh.exe	Get hash	malicious	RHADAMANTHYS	Browse	91.240.118.2
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	91.240.118.2

Process:	C:\Program Files\Windows Media Player\wmlaunch.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.207084092625156
Encrypted:	false
SSDEEP:	3072:j5U5KTQLGfn74TSt5wRTNpQjVX7jargKaCvlIxh1KhkSaKBKbkCBFw3WILu7bVrP:iuoSt5wRe7jJcEw5vH
MD5:	7C008EC74805466295B4A84F83441833
SHA1:	92F2543804553FC1AB045049119BB0EFDF6D1E6A
SHA-256:	CAEFD99FAC8BF9192F0C9D51FBA60AE7533E64B18A2B51F379DC0A2CB836E37F
SHA-512:	DB49795A0C5FEBA429F4CBF19CE78057720AE6FBC38A66B159E4E81BDE8FEB63CDD825803E9E9347E36DF8936B3CF10F2435100FE3C8224AA3CA8BF1B63C3EE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..........)....../.6..................)....../......+......+.....#...................(....Rich...........PE..L...0..a............................kx.......0....@.......................................@.................................\Q..x....`...S..........H....'...........]..T....................^.......]..@............P..X............................text...,........................... ..`.data...h....0....... ..............@....idata..8....P.......*..............@..@.rsrc....S...`...T...4..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Avt\goopdate.dll

Download File

Process:	C:\Program Files\Windows Media Player\wmlaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	6.825181681059735
Encrypted:	false
SSDEEP:	49152:8uCFYE56HuRKfMVxYOZrx8YHRT/FzyO7fC0Y:nCh0Hx6WOFxv2
MD5:	4B8959297330B8A9C40F8E7D4A94180C
SHA1:	3E2794400664F6AE9A9B27821BF01CA008F99E1D
SHA-256:	CB33D8860E275ED1BB222F07E833C8E441369D7137BB29795A9DB283B36B33FA
SHA-512:	942B608AB36AC21A7022D5271B3EECBA739DF47C56C621A69C7DF127544F491584A453AD45C561246ACA311EE54B0B8FC8902FF0D94BD159153EE752C64FBE64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......w..3..3..3..Lo.2..Lk."..Li...Lh.,...........$.....s..Ln.?..Lu....3.._..G...t..G...2..G.e.2..3......G...2..Rich3..................PE..L....]^...........!................Q........0...............................`......;}....@.........................P.......X................................P..........T..............................@............0...............................text............................... ..`.rdata..f....0......."..............@..@.data...........J..................@....rsrc................ ..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.636177932593967
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	lumma.exe
File size:	1'580'032 bytes
MD5:	96da4c9b10159e9a9a38a2e6aacbc984
SHA1:	0df08d596c3b70533420412ba1a544aeb34c66cc
SHA256:	5c92f798fdd43e235e03359efc6cb053d9aca99edd5f3be2eb4caf00e09e4fa3
SHA512:	9a42300c2b45aabe219e1df00d1a39a996226180bc654b877ea61433374afefe2ec8e0ea67423bee7c3af12d599b0be9fd0f05d5930e34e9566620fa1979b87b
SSDEEP:	24576:i29mLsyt+0g/q5FL5TmtfSTmlALoo2QcktBHS/0fyXifxKcG6:i29V5kUShovQcoe0aXifxKcG6
TLSH:	5575CF35E3B89136DA4E12B7E034071D56F6F40663CE7F8B5B24A5E8E8C27B1BD42192
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N.g............................^.... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x582e5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C44EB6 [Sun Mar 2 12:27:34 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x182e04	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x184000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x186000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x180e64	0x181000	d33b510f6de8ca0dd48ce7e9374f027f	False	0.8066488687094155	data	7.639579243837958	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x184000	0x628	0x800	694496667ec729f938617682da2cdc60	False	0.3349609375	data	4.5432721556907145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x186000	0xc	0x200	edc9b92ce58c12cdedee4207516c0c5f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1840a0	0x3d2	data			0.39161554192229037
RT_MANIFEST	0x184474	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	Apache HTTP Server
CompanyName	Apache Software Foundation
FileDescription	Apache HTTP Server
FileVersion	2.4.62.0
InternalName	Rick.exe
LegalCopyright	Copyright 2024 The Apache Software Foundation.
LegalTrademarks
OriginalFilename	Rick.exe
ProductName	Apache HTTP Server
ProductVersion	2.4.62.0
Assembly Version	2.4.62.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-04T12:46:18.545167+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	50064	TCP
2025-03-04T12:46:39.150557+0100	2833022	ETPRO MALWARE Possible Malicious Second Stage Download with Terse Headers	1	188.114.97.3	443	192.168.2.4	49734	TCP
2025-03-04T12:46:47.349945+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	9769	192.168.2.4	49735	TCP
2025-03-04T12:47:06.284033+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	9769	192.168.2.4	49745	TCP
2025-03-04T12:47:06.284033+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	91.240.118.2	9769	192.168.2.4	49745	TCP
2025-03-04T12:47:15.888964+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	9769	192.168.2.4	49780	TCP
2025-03-04T12:47:15.888964+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	91.240.118.2	9769	192.168.2.4	49780	TCP
2025-03-04T12:47:23.198537+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	49842	TCP
2025-03-04T12:47:29.809442+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	49891	TCP
2025-03-04T12:47:32.814207+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	9769	192.168.2.4	49912	TCP
2025-03-04T12:47:36.439586+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	49934	TCP
2025-03-04T12:47:43.045454+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	49975	TCP
2025-03-04T12:47:49.692836+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	50020	TCP
2025-03-04T12:47:49.931463+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	9769	192.168.2.4	50024	TCP
2025-03-04T12:47:49.931463+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	91.240.118.2	9769	192.168.2.4	50024	TCP
2025-03-04T12:47:56.453605+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	50059	TCP
2025-03-04T12:47:59.541065+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	9769	192.168.2.4	50060	TCP
2025-03-04T12:47:59.541065+0100	2854824	ETPRO JA3 HASH Suspected Malware Related Response	2	91.240.118.2	9769	192.168.2.4	50060	TCP
2025-03-04T12:48:04.083045+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	50061	TCP
2025-03-04T12:48:10.721863+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	50062	TCP
2025-03-04T12:48:17.345884+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	91.240.118.2	443	192.168.2.4	50063	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 12:46:38.226644039 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.226743937 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:38.226995945 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.237299919 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.237329960 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:38.709028006 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:38.709237099 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.713493109 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.713515997 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:38.713923931 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:38.764059067 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.771918058 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:38.819336891 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.060909033 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061033010 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061122894 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.061134100 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061162949 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061306953 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061392069 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061419964 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.061435938 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061569929 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.061577082 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.061863899 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.061870098 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.065628052 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.065711975 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.065747023 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.065753937 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.066039085 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.147279024 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.147511005 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.147581100 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.147592068 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.147758961 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.147820950 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.147825956 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.147901058 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.147952080 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.147958994 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.148168087 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.148240089 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.148245096 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.148345947 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.148395061 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.148401022 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.148968935 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.149033070 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.149039030 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.149112940 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.149163961 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.149169922 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.149960041 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150010109 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.150018930 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150093079 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150146008 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.150152922 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150228024 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150279999 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.150285959 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150686026 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150758982 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.150764942 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150868893 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.150935888 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.150940895 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.201359987 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.201390982 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234375954 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234456062 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234477997 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.234549046 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234618902 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.234637976 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234667063 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234741926 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.234755993 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234788895 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234859943 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.234859943 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.234883070 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234906912 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.234961987 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.234975100 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.235455036 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.235546112 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.235563993 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.235584021 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.235620975 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.236310959 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.236387014 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.236409903 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.236440897 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.236471891 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.236485004 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.236524105 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.237365961 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.237441063 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.237453938 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.237477064 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.237543106 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.237555027 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238424063 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238493919 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.238511086 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238534927 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238583088 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.238605022 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238636017 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238639116 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.238703012 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.238717079 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.238804102 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.239253998 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.239346981 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.239371061 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.239430904 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321398973 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.321464062 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.321505070 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321573019 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.321615934 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.321630955 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321660995 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.321677923 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321677923 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321696043 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.321723938 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321741104 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.321939945 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.322002888 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.322046041 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.322101116 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.322407007 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.322477102 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.322508097 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.322573900 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.322603941 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.322679043 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.322702885 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.322774887 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.323415995 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.323484898 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.323538065 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.323606014 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.323616982 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.323666096 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.323694944 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.323707104 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.323736906 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.323776960 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.324281931 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.324347019 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.324408054 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.324469090 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.324492931 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.324556112 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.325226068 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.325290918 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.325308084 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.325365067 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.325424910 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.325476885 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.325486898 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.325498104 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.325531006 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.326128960 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326180935 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326188087 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.326200962 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326246977 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326261044 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.326272011 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326301098 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.326318026 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326360941 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.326370955 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.326416969 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.326997995 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.327071905 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.327084064 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.327147007 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.408370972 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408477068 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408521891 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.408552885 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408582926 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.408584118 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408634901 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408655882 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.408672094 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408735991 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.408934116 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.408976078 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409010887 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.409025908 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409054041 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.409236908 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409281969 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409315109 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.409327984 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409380913 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.409679890 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409728050 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409759045 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.409774065 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.409807920 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.413455009 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.413499117 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.413539886 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.413552999 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.413595915 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.413794041 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.413836002 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.413880110 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.413892984 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.413921118 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.414113045 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.414156914 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.414201975 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.414212942 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.414243937 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.466996908 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.495518923 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.495572090 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.495640039 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.495666981 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.495714903 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.495819092 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.495865107 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.495884895 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.495893002 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.495923996 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.495960951 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496079922 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496124029 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496141911 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496149063 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496185064 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496212959 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496584892 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496627092 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496658087 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496666908 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496696949 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496757984 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.496922970 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496964931 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.496994019 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.497000933 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497029066 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.497080088 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.497241020 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497283936 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497311115 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.497318029 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497354031 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.497740984 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497781038 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497806072 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.497812986 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.497864962 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.498147011 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.498187065 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.498265028 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.498275042 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.545125008 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.582812071 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.582895041 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.582927942 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.582940102 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.582998037 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.583007097 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.583036900 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.583064079 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.583086967 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.583089113 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.583112001 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.583143950 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.583184004 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.583209038 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.583378077 CET	443	49734	188.114.97.3	192.168.2.4
Mar 4, 2025 12:46:39.583434105 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:39.595027924 CET	49734	443	192.168.2.4	188.114.97.3
Mar 4, 2025 12:46:46.639513016 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:46.645042896 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:46.645160913 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:46.645313978 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:46.650943041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.343429089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.344811916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.349945068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.570781946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.579603910 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.585357904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830127954 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830179930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830216885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830246925 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.830250978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830286026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830315113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830348969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830349922 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.830373049 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.830384970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830414057 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830450058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.830461979 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.830704927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.835556984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.835592985 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.835628033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.835695982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.844665051 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.844701052 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.844737053 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.844737053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.844860077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.958024979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.958045959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.958116055 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.958126068 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.963038921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.963073015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.963109970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.963135004 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.963145018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.963155985 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.971507072 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.971544981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.971579075 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.971635103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.971663952 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.971674919 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.980551004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.980587959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.980623960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.980654001 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.980684042 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.989480972 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.989526987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.989626884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.989660025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.989726067 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.998411894 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.998466015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.998533964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.998564005 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:47.998598099 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:47.998627901 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.006724119 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.006781101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.006844044 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.007400036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.007430077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.007512093 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.015170097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.015206099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.015254974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.015285015 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.023358107 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.023413897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.023425102 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.023500919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.023529053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.023686886 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.031836033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.031871080 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.031905890 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.031910896 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.031985044 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.045017958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.045053959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.045088053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.045150995 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.048628092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.048691034 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.048752069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.048782110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.048815966 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.086380959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.086412907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.086462975 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.086467981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.086523056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.086530924 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.090375900 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.090449095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.090485096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.090507030 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.090537071 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.098711014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.098757029 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.098795891 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.098831892 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.098851919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.098942995 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.106518984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.106548071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.106602907 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.106602907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.106631994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.106729984 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.114250898 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.114285946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.114320993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.114348888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.122050047 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.122086048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.122119904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.122121096 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.122168064 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.129983902 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.130042076 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.130076885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.130093098 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.137425900 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.137455940 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.137484074 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.137542009 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.137597084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.137602091 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.145231962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.145279884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.145313025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.145319939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.145359993 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.152854919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.152909040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.152957916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.153043985 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.153073072 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.153117895 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.160731077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.160765886 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.160799980 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.160852909 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.168170929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.168209076 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.168226957 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.168243885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.168407917 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.175242901 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.175280094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.175331116 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.175386906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.181855917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.181936979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.181967020 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.181984901 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.182075977 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.189027071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.189086914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.189136028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.189184904 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.194453955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.194489956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.194516897 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.194529057 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.194574118 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.200354099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.200431108 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.200465918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.200515985 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.206305027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.206387043 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.206407070 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.206461906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.206491947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.206537008 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.212218046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.212274075 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.212285995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.212374926 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.212404013 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.212425947 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.218256950 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.218291998 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.218326092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.218353987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.218375921 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.224142075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.224200964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.224234104 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.224287987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.230139017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.230169058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.230207920 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.230268955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.230298042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.230353117 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.233867884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.233901978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.233937025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.233937979 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.233987093 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.237349987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.237406015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.237517118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.237545967 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.237576008 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.237608910 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.240981102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.241018057 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.241055965 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.241106987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.244609118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.244645119 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.244671106 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.244679928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.244755030 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.248121977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.248156071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.248191118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.248281002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.251792908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.251842022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.251879930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.251898050 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.251929045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.255218029 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.255266905 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.255310059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.255347013 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.255402088 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.255460978 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.258826971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.258862972 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.258897066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.258966923 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.262265921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.262317896 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.262326956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.262353897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.262407064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.262459993 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.265835047 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.265866041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.265893936 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.265985012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.266014099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.266037941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.269388914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.269423962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.269443989 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.269457102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.269509077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.272799015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.272829056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.272885084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.272958040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.272986889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.273046017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.276212931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.276242018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.276316881 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.276367903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.276395082 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.276447058 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.279791117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.279825926 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.279861927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.279915094 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.283276081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.283310890 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.283361912 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.283369064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.283601046 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.286602020 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.286636114 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.286686897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.286714077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.290018082 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.290050983 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.290083885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.293508053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.293544054 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.293576956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.296899080 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.296932936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.296967030 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.299705982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.300291061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.300323963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.300357103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.300420046 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.303628922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.303666115 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.303690910 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.303700924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.303994894 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.307147026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.307179928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.307214022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.307275057 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.310425997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.310476065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.310509920 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.310513020 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.310574055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.314035892 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.314069986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.314105034 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.314143896 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.316981077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.317047119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.317054987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.317186117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.317215919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.317250013 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.320286989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.320341110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.320400953 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.320470095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.320524931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.320533037 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.323611975 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.323666096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.323672056 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.323739052 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.323766947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.323797941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.326798916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.326853037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.326858997 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.327017069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.327045918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.327071905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.329998970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.330053091 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.330074072 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.330176115 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.330204964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.330231905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.333416939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.333446026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.333476067 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.333548069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.333576918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.333606958 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.336539984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.336577892 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.336611986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.336611986 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.337012053 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.339627028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.339673042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.339726925 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.339732885 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.339755058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.339804888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.342674971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.342730999 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.342762947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.342788935 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.345885038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.345920086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.345940113 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.345953941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.346005917 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.348896027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.348946095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.348980904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.348997116 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.351902008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.351937056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.351963997 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.351972103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.352026939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.354898930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.354928017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.354999065 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.355066061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.355093956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.355144978 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.358010054 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.358037949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.358088970 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.358163118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.358191013 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.358294010 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.361035109 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.361068964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.361102104 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.361130953 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.363780975 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.363811016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.363847017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.363847971 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.363898993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.363903999 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.366734028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.366767883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.366801977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.366837978 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.366877079 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.369101048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.369134903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.369168043 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.369229078 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.371473074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.371500969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.371556044 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.371650934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.371680975 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.371731997 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.373956919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.373990059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.374022961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.374027014 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.374073982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.376116991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.376152039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.376183987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.376236916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.380384922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.380419016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.380444050 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.380453110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.380508900 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.380647898 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.380697012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.380729914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.380759954 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.382869959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.382916927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.382929087 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.382973909 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.383002996 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.383053064 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.384952068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.384982109 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.385010958 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.385036945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.385065079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.385096073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.386951923 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.387008905 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.387012005 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.387049913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.387104034 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.389113903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.389148951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.389182091 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.389206886 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.391102076 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.391158104 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.391159058 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.391191959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.391252995 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.393220901 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.393255949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.393290997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.393317938 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.395113945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.395153046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.395174026 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.395204067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.395267010 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.397129059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.397162914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.397209883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.397278070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.399018049 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.399046898 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.399076939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.399166107 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.399194956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.399224043 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.400959015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.400986910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.401015043 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.401067019 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.401120901 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.401127100 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.402884960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.402920008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.402937889 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.402954102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.403007984 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.404719114 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.404762030 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.404817104 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.404845953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.405086994 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.406835079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.406867981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.406899929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.406930923 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.408355951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.408390045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.408411026 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.408438921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.408837080 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.410221100 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.410254955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.410289049 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.410358906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.411932945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.411986113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.411990881 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.412054062 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.412081957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.412137985 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.413767099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.413795948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.413825989 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.413913965 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.413942099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.413996935 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.415535927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.415565014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.415595055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.415647984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.415700912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.415752888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.417315006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.417347908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.417373896 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.417381048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.417474031 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.419114113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.419143915 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.419178963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.419233084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.419250011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.419302940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.420726061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.420753956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.420855999 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.420883894 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.420892954 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.420928955 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.422549963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.422584057 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.422616959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.422676086 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.424174070 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.424209118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.424241066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.424241066 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.424316883 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.425709963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.425744057 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.425776958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.425801039 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.427417040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.427450895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.427473068 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.427484035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.427536964 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.429177046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.429204941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.429259062 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.429259062 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.429290056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.429343939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.430624962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.430660009 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.430691957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.430726051 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.432235003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.432271004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.432290077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.432306051 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.432369947 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.433748007 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.433794022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.433845043 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.433852911 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.433872938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.433923960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.435393095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.435425997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.435458899 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.435487032 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.436825991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.436881065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.436892033 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.436933994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.436961889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.437001944 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.438383102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.438416958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.438441038 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.438450098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.438500881 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.440193892 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.440243006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.440279961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.440299034 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.441450119 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.441482067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.441508055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.441551924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.441582918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.441607952 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.442991018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.443027020 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.443063021 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.443092108 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.443124056 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.445099115 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.445133924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.445167065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.445200920 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.448081970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.448116064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.448143959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.448151112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.448204041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.448215008 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.448240042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.448292017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.453835964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.453875065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.453928947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.453942060 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.453963995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.454000950 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.454021931 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.454036951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.454102993 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.454195023 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458648920 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458686113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458719015 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.458723068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458761930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458781958 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.458795071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458832979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.458853960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.467480898 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467515945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467541933 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.467550039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467612982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.467749119 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467783928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467818975 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467838049 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.467854023 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467888117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.467926979 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.470072031 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470104933 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470134020 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.470139980 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470172882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470205069 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.470207930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470246077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470305920 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.470417023 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.470472097 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489061117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489113092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489146948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489187956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489202976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489238024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489259005 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489293098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489345074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489357948 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489378929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489415884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489437103 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489471912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489507914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489521980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489542007 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489576101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489609957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489631891 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489643097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489658117 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489680052 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489715099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489732027 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489748955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489785910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489820004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489839077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.489855051 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.489875078 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.493942976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494000912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494004965 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.494057894 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494095087 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494102955 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.494128942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494164944 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494195938 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.494369030 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.494426012 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.497601986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497642040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497678995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497704029 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.497710943 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497745991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497766972 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.497797012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497831106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.497860909 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.503384113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503438950 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503443003 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.503474951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503509045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503537893 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.503545046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503580093 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503593922 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.503770113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.503866911 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.508054018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.508090019 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.508145094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.508153915 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.508178949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.508213043 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.508234978 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.508248091 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.508358955 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.508465052 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513187885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513241053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513242960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.513278961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513314009 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513348103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513381958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513428926 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.513428926 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.513571024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.513628960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.517802000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.517857075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.517894030 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.517911911 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.517927885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.517961979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.517997026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.518009901 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.518048048 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.518196106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.520950079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521003962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521039963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521064997 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.521073103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521099091 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.521106958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521142960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521156073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.521332026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.521384954 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.525711060 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.525763988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.525799036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.525818110 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.525835037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.525868893 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.525886059 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.525904894 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.525991917 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.526130915 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530292988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530328035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530345917 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.530364990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530400038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530441046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530448914 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.530498028 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.530498981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530535936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.530591011 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.535203934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535275936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535352945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535375118 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.535388947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535434008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535446882 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.535471916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535511971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.535527945 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.541038990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541095018 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.541112900 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541150093 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541187048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541205883 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.541224957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541260958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541280031 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.541368008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.541425943 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.557163000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557224989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557281017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557292938 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.557317972 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557352066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557385921 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.557388067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557446003 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.557610989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557646036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557715893 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557749987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557770967 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.557787895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557801008 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.557823896 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.557943106 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.558463097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.558497906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.558567047 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.569195032 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569240093 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569276094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569292068 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.569330931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569365025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569386959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.569678068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569711924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569736958 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.569750071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569781065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.569809914 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.570034027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570063114 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570095062 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.570173025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570224047 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.570230007 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570264101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570318937 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570353031 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570357084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.570388079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.570415020 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.575195074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575229883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575253963 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.575280905 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575351000 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.575377941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575412035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575447083 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575472116 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.575480938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575527906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.575552940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.580987930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581022978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581039906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.581057072 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581108093 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.581165075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581217051 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581252098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581268072 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.581285954 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581319094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.581345081 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.584465981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584521055 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584525108 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.584557056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584592104 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584624052 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.584626913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584661961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584717989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.584723949 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.584831953 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.595014095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595047951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595083952 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595109940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.595118999 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595232010 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.595264912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595339060 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595375061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595395088 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.595407963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595443964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595462084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.595482111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.595535994 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.595968962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.596024036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.596059084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.596091986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.596096039 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.596127033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.596143961 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.599973917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600003958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600034952 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.600055933 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600116014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600121021 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.600171089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600203991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600219011 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.600239992 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600275993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.600295067 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.604690075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.604724884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.604749918 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.604759932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.604810953 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.604816914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.604923010 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.604957104 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.604993105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.605011940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.605022907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.605043888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.607903957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.607938051 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.607971907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.607996941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.608015060 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.608021021 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.608048916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.608083010 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.608141899 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.608345985 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.608381987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.608433008 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.612524986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612554073 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612581968 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.612638950 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612694025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612699986 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.612730026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612776995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612786055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.612813950 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612860918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.612860918 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.617050886 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617080927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617113113 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.617115974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617172003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617172003 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.617229939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617312908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617347002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617347956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.617383003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.617439032 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.627942085 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.627971888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628007889 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.628091097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628125906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628164053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628185987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.628217936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628228903 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.628252029 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628285885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628320932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628345013 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.628385067 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.628927946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.628981113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.629018068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.629038095 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.629051924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.629086018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.629110098 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.629115105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.629162073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.641760111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.641814947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.641866922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.641901016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.641904116 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.641937017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.641971111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.641989946 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.642005920 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.642026901 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.644027948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644064903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644100904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644125938 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.644155979 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.644182920 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644217968 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644253016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644267082 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.644416094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644471884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.644480944 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.656284094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656327963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656368971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656371117 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.656404972 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656439066 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.656555891 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656590939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656625986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656626940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.656657934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.656708002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.662168980 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662242889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662302017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.662312984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662343025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662364960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.662431002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662466049 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662502050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662514925 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.662537098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662552118 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.662939072 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.662972927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663008928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663027048 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.663043022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663058996 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.663079023 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663382053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663435936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663446903 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.663470984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663491011 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.663503885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.663675070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.668169022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668224096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668261051 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668296099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668311119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.668344975 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.668350935 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668385029 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668421030 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.668471098 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.671477079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671511889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671551943 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671586037 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.671608925 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.671624899 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671680927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671716928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671751022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671751976 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.671786070 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.671802044 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.682068110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682132959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.682141066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682194948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682231903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682312012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682328939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.682364941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.682429075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682481050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682518005 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682549000 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.682550907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682586908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682620049 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682648897 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.682656050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.682672977 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.683208942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.683244944 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.683264017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.687347889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687402010 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687438011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687464952 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.687473059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687486887 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.687509060 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687546015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687594891 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.687614918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.687670946 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.691740036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.691797018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.691828012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.691855907 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.691859961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.691948891 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.692002058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.692004919 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.692038059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.692053080 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.692091942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.692222118 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.692351103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695082903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695146084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695158958 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.695183039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695219040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695255041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695272923 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.695291996 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695307016 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.695352077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.695436954 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.699628115 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699661016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699719906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.699774027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699809074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699862003 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.699862003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699928045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699964046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.699978113 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.700249910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.700309038 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.704194069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704248905 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704284906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704319000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704354048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704374075 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.704386950 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704415083 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.704423904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.704440117 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.715114117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715192080 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715226889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715261936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715266943 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.715308905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.715373039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715406895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715445042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715457916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.715475082 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715491056 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.715779066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715812922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715841055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.715851068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715884924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.715907097 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.716222048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.716257095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.716290951 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.716294050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.716324091 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.716350079 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.728842974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.728882074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.728915930 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.728936911 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.728971958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.729006052 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.729038000 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.729039907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.729077101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.729079962 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.729218960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.731173038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731209040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731264114 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731297970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731301069 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.731355906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731389046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731406927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.731426954 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.731446981 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.743421078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743454933 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743490934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743499041 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.743525982 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743555069 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.743704081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743736982 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743769884 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.743772984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743803024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.743824005 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.749321938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749393940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.749420881 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749450922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749509096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749515057 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.749542952 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749579906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749594927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.749615908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.749680042 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.750046015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750097990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750133991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750149012 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.750168085 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750204086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750237942 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.750598907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750633001 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750652075 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.750669956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750698090 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.750726938 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.758519888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758549929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758575916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.758603096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758636951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758654118 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.758694887 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758728981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758769035 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.758769989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758805037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758840084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.758857965 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.758882046 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.759555101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.759588957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.759625912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.759658098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.759685993 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.759716034 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.759825945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.759880066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.759943008 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.769087076 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769160986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769191027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769207954 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.769243956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769277096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769294977 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.769452095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769506931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769514084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.769541979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769577026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769607067 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.769884109 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769912004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.769951105 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.770062923 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.770113945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.770144939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.770148039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.770180941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.770215988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.770222902 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.770250082 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.770263910 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.778748989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.778785944 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.778819084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.778825045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.778856039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.778862953 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.778888941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.778922081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.778939962 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.779159069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.779213905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.779215097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800128937 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800154924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800173044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800194979 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.800200939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800216913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800232887 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.800239086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800255060 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800263882 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.800344944 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.800558090 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800574064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800601959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800616980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.800661087 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800677061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800693035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800710917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.800723076 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.800743103 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.801460981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801476002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801491022 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801512957 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.801513910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801529884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801533937 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.801549911 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801582098 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.801588058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.801637888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.802284002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.802334070 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.802350998 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.802386045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.802443027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.802458048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.802474976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.802490950 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.802521944 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.802989006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803021908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803040028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803090096 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.803261995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803328037 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.803329945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803347111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803364038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803405046 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.803730011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.803785086 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.815825939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.815859079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.815910101 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.815947056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.815960884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816009045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.816044092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816123962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816139936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816155910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816184044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816186905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.816199064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816214085 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.816216946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816267967 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.816983938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.816999912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.817018032 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.817034960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.817035913 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.817059994 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.818135977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818165064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818180084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818193913 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.818242073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.818360090 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818376064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818391085 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818423033 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.818627119 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818655014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.818680048 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.830493927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830528021 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830553055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.830565929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830600977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830651999 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.830673933 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830728054 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830737114 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.830761909 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830797911 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.830815077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.836549044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836622953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836651087 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.836677074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836711884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836730957 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.836747885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836781025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836802959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.836817026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.836879015 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.845629930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845685005 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845721006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845750093 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.845755100 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845805883 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.845875978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845930099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845967054 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.845985889 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.845999956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846035957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846069098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846081018 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.846105099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846118927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.846724987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846759081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846802950 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.846813917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846848011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846864939 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.846883059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846918106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846955061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.846976995 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.847012997 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.847604990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.847640038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.847676992 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.847692013 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.856256962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856292009 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856314898 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.856342077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856393099 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.856467962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856518984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856554031 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856570005 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.856587887 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856622934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856657028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856673956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.856693983 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.856697083 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.857280016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.857315063 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.857338905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.857351065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.857386112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.857403040 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.865854979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865870953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865888119 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865906954 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865915060 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.865925074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865936041 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.865950108 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865967035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.865981102 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.866005898 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.887152910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887168884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887185097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887223959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.887248993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887265921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887280941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887299061 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.887330055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.887520075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887593031 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887609005 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887624025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887644053 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.887681961 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.887917995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887959003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.887974977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888005018 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.888048887 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888066053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888092041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888098001 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.888109922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888154984 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.888796091 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888812065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888827085 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888844967 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888858080 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.888859987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888875008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.888875961 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.888906002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.889471054 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889486074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889503002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889522076 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.889545918 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.889564037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889580965 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889595985 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889612913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.889625072 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.889664888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.902894974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903012037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903043032 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903069019 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903100014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903136015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903146982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903170109 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903206110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903228045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903239012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903295040 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903435946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903469086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903522968 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903539896 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903557062 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903661013 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903755903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903790951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903862000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903882980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.903897047 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903929949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.903997898 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.904170036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.904221058 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.904226065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.904261112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.904294968 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.904314041 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.904330969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.904365063 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.904385090 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.905289888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905319929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905373096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905395985 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.905406952 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905435085 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.905462027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905497074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905510902 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.905533075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905566931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.905586958 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.917550087 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917639971 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.917646885 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917679071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917712927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917747021 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917748928 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.917795897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917800903 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.917895079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.917932987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.918006897 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.923729897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.923763990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.923789024 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.923819065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.923852921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.923887968 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.923892975 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.923923969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.923974037 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.923991919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.924045086 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.932910919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.932964087 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933017015 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933018923 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933054924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933089972 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933104992 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933125019 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933173895 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933177948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933214903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933320045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933343887 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933353901 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933388948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933422089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933437109 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933455944 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933489084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933489084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933552027 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933830023 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933865070 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933901072 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933933973 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933955908 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.933968067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.933985949 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.934000969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.934036970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.934050083 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.943407059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943459988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943464994 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.943494081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943526983 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943547010 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.943564892 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943617105 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.943618059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943655014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.943705082 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.952914000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.952970982 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953005075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953058004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953068972 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953090906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953107119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953125954 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953360081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953393936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953422070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953428984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953439951 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953463078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953499079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953531981 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953532934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953584909 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953753948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953788042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953820944 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953866959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.953895092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.953950882 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.974201918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974239111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974276066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974304914 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.974309921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974379063 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.974400997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974436045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974493980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.974509954 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974544048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974580050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974601030 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.974615097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974651098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.974666119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975048065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975083113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975116014 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975116968 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975150108 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975164890 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975186110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975308895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975332022 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975378036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975433111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975454092 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975466967 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975501060 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975527048 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975553989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975589037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975624084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975646973 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975657940 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975687981 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.975692987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975730896 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.975783110 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.976310015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.976365089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.976372957 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990107059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990166903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990187883 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990227938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990263939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990281105 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990320921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990354061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990390062 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990405083 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990442991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990442991 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990478992 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990513086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990549088 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990564108 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990597010 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990674973 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990709066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990761995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990794897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990813971 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990829945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.990863085 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.990863085 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991089106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991142988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991158009 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.991178989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991199017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.991214037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991440058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991475105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.991489887 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.991529942 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.992336035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992383003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992438078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992441893 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.992472887 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992510080 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992543936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992564917 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.992604017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:48.992676973 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.992712975 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:48.995704889 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.005443096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005479097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005512953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005532026 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.005547047 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005579948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005613089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005614042 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.005650997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005676031 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.005681038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.005728960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020100117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020168066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020204067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020243883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020257950 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020281076 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020293951 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020337105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020391941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020426989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020442963 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020462036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020481110 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020498991 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020531893 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020548105 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020567894 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020601988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020638943 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.020642996 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020737886 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.020997047 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021030903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021066904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021121025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021131992 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.021157980 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021188021 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.021192074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021228075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021245956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.021262884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021296978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021313906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.021332026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021368980 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021387100 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.021800995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021858931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021863937 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.021894932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.021948099 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.032768011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.032808065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.032871008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.032907009 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.032912016 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.032943964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.032987118 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.032994032 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.033029079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.033046961 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.033065081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.033114910 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.040267944 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040344000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040384054 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040409088 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.040426016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040462017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040497065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040520906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.040532112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.040539980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.040570021 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.041698933 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061306953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061378956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061414957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061439037 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061451912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061486006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061499119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061534882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061592102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061609983 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061633110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061682940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061686993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061722040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061754942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061793089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.061808109 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061850071 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.061961889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062016010 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062051058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062103987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062128067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062161922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062175989 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062196970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062246084 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062463045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062530994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062578917 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062585115 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062621117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062657118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062673092 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062714100 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062747955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062776089 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062783003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062817097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062835932 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.062851906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062887907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.062902927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.063590050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.063627005 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.063644886 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.063662052 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.063695908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.063731909 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.063736916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.063766956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.063786983 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077049017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077106953 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077116966 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077152014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077208042 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077209949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077244997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077280045 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077292919 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077313900 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077348948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077358007 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077446938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077476025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077491045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077531099 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077575922 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077606916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077641964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077677965 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077687979 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077747107 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077790976 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077800035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077836990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077872038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077882051 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077925920 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077961922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.077970028 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.077996969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.078032017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.078038931 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.078067064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.078115940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.079353094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079412937 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079443932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079510927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.079511881 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079546928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079586983 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.079602003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079631090 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079662085 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.079689026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079725027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.079772949 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.091907978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.091974974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.091988087 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.092031002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.092066050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.092081070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.092101097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.092134953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.092156887 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.092170000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.092205048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.092217922 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107110977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107146978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107165098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107177973 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107211113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107227087 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107228041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107347965 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107378960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107402086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107426882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107505083 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107522011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107531071 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107655048 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107672930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107757092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107783079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107810020 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107810974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107826948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107842922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.107850075 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.107867956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108139992 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108156919 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108174086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108206034 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108230114 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108247042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108259916 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108263016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108280897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108310938 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108338118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108354092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108361006 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108372927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108386993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108403921 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108437061 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.108896017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108941078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108966112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108979940 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.108994007 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.109019995 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.117691040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117711067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117728949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117762089 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.117765903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117782116 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117799044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117816925 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.117818117 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.117851973 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.127249956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127271891 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127300024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127325058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127342939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127348900 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.127377987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.127471924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127490044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.127505064 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.127543926 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.148483038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148538113 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148555994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148578882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148596048 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148612976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148629904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148643017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.148648977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148679972 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.148744106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148758888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148760080 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.148777008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148847103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148863077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148876905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.148880005 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148899078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.148910999 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.148931980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.149229050 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149267912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149283886 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149301052 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.149391890 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.149405956 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149421930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149449110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149462938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149472952 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.149481058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149496078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149511099 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.149513006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149530888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.149538994 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.149580956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.150094986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150113106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150156975 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.150213957 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150229931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150247097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150274038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150275946 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.150288105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150305033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150321960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.150332928 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.150367022 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164387941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164411068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164428949 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164447069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164479017 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164516926 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164567947 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164573908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164591074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164608955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164653063 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164731026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164747953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164767027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164773941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164813042 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164865971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164882898 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164901018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164937973 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.164978027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.164994955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165011883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165024996 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.165034056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165062904 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.165110111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165128946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165157080 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.165525913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165544987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.165654898 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.166507959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.166538000 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.166555882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.166790962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.166837931 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.166841984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.166883945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.166893959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.166922092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.167295933 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.179081917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179112911 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179163933 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179166079 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.179199934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179234028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179250002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.179302931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179377079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179409027 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.179409981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179445028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.179459095 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.194330931 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194577932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194638968 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194674969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194679976 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.194729090 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194761038 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.194762945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194797039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194828033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194828987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.194880962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194914103 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.194932938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194967031 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.194997072 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.194998980 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195031881 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195064068 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195064068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195097923 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195130110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195130110 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195198059 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195234060 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195250988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195283890 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195285082 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195343971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195394993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195426941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195427895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195477962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195508957 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195512056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195544958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195570946 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195580006 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195609093 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195615053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195647955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195662975 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.195683002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.195735931 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.196012020 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.204785109 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.204839945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.204847097 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.204875946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.204926014 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.204926014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.204961061 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.205009937 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.205028057 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.205061913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.205110073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.214418888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214477062 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214529037 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214557886 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.214560986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214596033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214628935 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.214628935 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214668036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.214679003 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.235855103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.235888958 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.235924006 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.235959053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.235991001 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236041069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236073017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236104012 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236108065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236140013 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236174107 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236202002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236206055 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236443996 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236475945 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236475945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236529112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236552000 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236562014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236591101 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236596107 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236629009 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236655951 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236684084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236715078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236738920 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.236751080 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.236800909 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237103939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237137079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237169981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237185001 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237219095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237251997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237268925 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237284899 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237318993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237333059 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237349987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237384081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237396002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237431049 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237464905 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237474918 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237793922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237827063 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237843037 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237860918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237895966 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237906933 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.237927914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.237974882 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.251403093 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251456976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251486063 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251538038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251544952 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.251590967 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251605988 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.251626015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251677036 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.251677036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251712084 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251759052 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.251861095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251893044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251938105 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.251943111 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.251976013 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252007961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252022028 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.252300978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252334118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252367973 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252388000 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.252401114 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252428055 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.252434015 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252466917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252499104 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.252587080 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252618074 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252634048 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.252650976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.252693892 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.252716064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253799915 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253833055 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253865004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253885031 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.253920078 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253948927 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.253953934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253988028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.253995895 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.254020929 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.254072905 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.254113913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266359091 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266387939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266438961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266442060 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.266473055 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266506910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266515970 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.266539097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266568899 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.266573906 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266669035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.266750097 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281251907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281305075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281339884 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281353951 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281388998 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281419039 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281455040 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281487942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281518936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281519890 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281558990 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281600952 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281624079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281682014 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281704903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281737089 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281877995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281879902 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281928062 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281960011 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.281991005 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.281991959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282023907 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282040119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.282238960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282270908 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282321930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282355070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.282356024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282391071 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282409906 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.282423973 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282454014 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.282458067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.282505989 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.291945934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292011976 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292062044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292094946 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292145014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292177916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292211056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292382002 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292412996 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292464018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292495966 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292543888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292577028 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292610884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.292643070 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.295422077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.301557064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301609993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301610947 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.301677942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301709890 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301723957 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.301743031 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301775932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301789045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.301810026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.301856041 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.322870970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.322899103 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.322947979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.322978973 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.322981119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323014021 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323043108 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323045969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323081017 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323085070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323247910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323297977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323329926 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323348999 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323381901 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323461056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323467970 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323493004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323522091 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323527098 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323559046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323599100 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323642969 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323690891 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323873043 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323909044 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323944092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.323972940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.323993921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324026108 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324058056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324064970 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.324095964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324126959 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.324146032 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324178934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324207067 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.324210882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324261904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324295998 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324321032 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.324322939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324457884 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.324877024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324908972 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324928045 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.324943066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324975014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.324987888 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.325007915 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.325041056 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.325053930 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.325074911 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.325120926 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.338769913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.338805914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.338838100 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.338870049 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.338886976 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.338920116 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.338952065 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.338953018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.338987112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339016914 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339047909 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.339049101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339082003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339108944 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.339133978 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339147091 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.339183092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339216948 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339248896 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339267969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339299917 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.339348078 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.339397907 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.340840101 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.340867996 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.340914011 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.340918064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.340965986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.340998888 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.341031075 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.341036081 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.341064930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.341095924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.341097116 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.341186047 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.353709936 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353739977 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353787899 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353817940 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.353821993 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353854895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353889942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353921890 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353921890 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.353957891 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.353990078 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.355987072 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.368415117 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368464947 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368499041 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368508101 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.368531942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368566036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368578911 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.368599892 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368650913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368684053 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368716002 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.368733883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368766069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368798018 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.368798971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368838072 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.368870020 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.368976116 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369008064 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369015932 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369059086 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369091988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369095087 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369124889 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369155884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369157076 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369195938 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369259119 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369421959 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369473934 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369477987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369643927 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369678974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369713068 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369726896 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369745016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369774103 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369779110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369812012 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.369843960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.369843960 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.370016098 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379051924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379107952 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379137039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379189014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379192114 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379221916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379256010 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379256010 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379343033 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379390955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379426003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379579067 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379611969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379628897 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379646063 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379681110 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379681110 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379717112 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379770994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379802942 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379803896 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.379848003 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.379878998 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.380315065 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.380872965 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.380872965 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.388561964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388613939 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388647079 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388693094 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388725042 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388756990 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.388792992 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388825893 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.388928890 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410167933 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410243988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410264969 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410279036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410314083 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410348892 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410381079 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410407066 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410440922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410443068 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410470963 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410501003 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410521984 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410554886 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410588026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410588980 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410620928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410651922 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410675049 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410708904 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410708904 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410763979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410847902 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.410868883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410902023 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.410933971 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411005974 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411039114 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411096096 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411147118 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411180019 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411190987 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411210060 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411212921 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411247969 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411283016 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411320925 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411335945 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411374092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411402941 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411406994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411436081 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411439896 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411473036 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411500931 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411508083 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.411592960 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.411964893 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.412019014 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.412067890 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.412100077 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.412115097 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.412133932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.412189007 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.425693035 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.425745010 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.425757885 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.425780058 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.425815105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.425842047 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.425848961 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.425915956 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.425918102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.425971985 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426018953 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426054001 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426063061 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.426083088 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426115036 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.426117897 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426167965 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426168919 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.426201105 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426234007 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426265001 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426297903 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.426443100 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.427990913 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428041935 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428045034 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.428076982 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428109884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428143024 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428175926 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.428179026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428215027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.428246021 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.428318977 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.432276011 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.432276011 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.440594912 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440623999 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440659046 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440733910 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440757990 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.440762997 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440787077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.440813065 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440846920 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440854073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.440879107 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.440913916 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.441092968 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.455503941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455554008 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455590963 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.455621004 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455672979 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455707073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.455708027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455741882 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455774069 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455775023 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.455807924 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455841064 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.455842018 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.455926895 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456065893 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456099033 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456130981 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456163883 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456196070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456212044 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456216097 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456269026 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456305027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456341982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456399918 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456449986 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456479073 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456485987 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456537962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456571102 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456600904 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456620932 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456645966 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456655025 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456691027 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.456712961 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.456723928 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.457048893 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.457051039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.457118988 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.457149982 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.457179070 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.457182884 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.457293034 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.459923983 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466217995 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466269970 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466320038 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466340065 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466356039 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466388941 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466420889 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466422081 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466456890 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466489077 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466609955 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466661930 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466696978 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466711998 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466746092 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466775894 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466778994 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466811895 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466846943 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.466846943 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.466932058 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.475641966 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475675106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475728989 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475737095 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.475780964 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475831032 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.475831985 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475886106 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475919962 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475934982 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.475948095 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.475996971 CET	49735	9769	192.168.2.4	91.240.118.2
Mar 4, 2025 12:46:49.497200966 CET	9769	49735	91.240.118.2	192.168.2.4
Mar 4, 2025 12:46:49.497232914 CET	9769	49735	91.240.118.2	192.168.2.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lumma.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Avt\AvastBrowserUpdate.exe

C:\Users\user\AppData\Roaming\Avt\goopdate.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
lumma.exe